Doctor Web presents the virus activity review for February 2009. As a traditional January “vacation” came to an end, cyber criminals got back to their work. The last month saw a significantly increased number of malicious programs used to turn computers into zombies.

Botnets

A large number of malicious programs are spread in order to increase the number of zombie computers in botnets. Tdss and Virut are common examples of rapidly growing zombie networks.

Let’s take a closer look at one of the methods of infection used by owners of the Tdss botnet. They disguise malicious code as a video codec typically copied to a hard drive from a removable media. The malicious program is detected by Dr.Web as Win32.HLLW.Autoruner.4612. If launched the virus will infect available hard and removable drives and create its additional component also detected by Dr.Web as Win32.HLLW.Autoruner.4612

In order to launch the second malicious file the virus makes a modified copy of a system library that entered the Dr.Web virus database as Trojan.Starter.896. One of system services is restarted in order to make the system use the modified library.

Win32.HLLW.Autoruner.4612 is a backdoor – a remote administration program installed in a system without an authorization of the user and controlled by a cyber-criminal. Luckily actions performed by this particular backdoor are limited to downloading of executable files from a server. Win32.HLLW.Autoruner.4612 initiates a file transfer and receives encrypted files and instructions required to download and launch other malicious programs.

One of such programs is Trojan.DnsChange.1008 that changes DNS settings on the computer that may allow a virus maker to intercept Internet traffic of a user and block access to the Internet.

Owners of Virut use the Win32.Virut polymorphic virus that infects executable files of Windows and adds a special tag at the end of HTML documents. Opening such a document initiates downloading of malicious programs from servers of the botnet. This is the main reason why the virus is often detected in mail traffic as users often attach HTML documents modified by the virus to their messages. Consequently the virus takes top positions in statistic reports on malware in e-mail traffic even if there are no notable mass mailings spreading malicious code.

The latest version of Win32.Virut.56 uses several infection techniques depending on the structure of a file it infects. However, the encrypted code of the virus body is always written at the end of the file. The code for decryption is placed in unused segments of the infected file. The code is polymorphic meaning it differs from file to file. Besides, the polymorphic code may include the code of an infected file if it is required to infect it.

Win32.Virut.56 also features its own IRC-client used to receive commands to download and launch other malicious programs on an infected machine.

In first two weeks of February many users received messages that contained links to bogus web-sites supposedly offering St. Valentine Day greetings. Instead of a greeting card a user downloaded one of the numerous modifications of Trojan.Spambot – a malicious program that uses an infected machine to send out spam.

Keen to make quick money virus makers often fail to test their works properly and lose profit even though damage is still done to data of a victim. Trojan.Encoder.36 wrote its code into document files on a hard drive of a victim, so the user couldn’t open such files. However, the Trojan didn’t display the account information so that the victim could pay for decryption. Users whose file s were corrupted by the malicioius program can scan such files using Dr.Web software to restore them to their original state.

Even though the number of spam messages with attached malicious code moved down, one could still find e-mails with attached malware. At the end of February some users received messages notifying them that a photo of the user was published on a web-site in the Internet. The supposed photo was attached to the message as a zip-archive. The archive contained the file with the name Foto_Jenna.Jpg[series of underscores].exe detected by Dr.Web as Trojan.DownLoad.9125.

Spam

It seems that the worldwide economic slowdown boosted business of spammers .Many companies receive offers to promote their products and services in the Interne. Little wonder that the promotion is limited to spam messages containing information about the company. In last two weeks of February such messages increased amount of spam traffic at such a rate that if the growth continues in the next month, it will exceed amount of spam traffic registered at the beginning of December 2008 prior to the closure of the hosting companies responsible for a large share of spam traffic..

Number of phishing messages and other scams in English also went down while the number of scams in native languages of recipients increased. In February phishing attacks offering messages in native languages of users were received by customers of the Praveks bank (Ukraine) and customers of the Raiffeisen Bank in Romania.

Malicious programs detected in mail traffic in February

Malicious programs detected on user machines in February