Doctor Web, Ltd presents the virus activity review for July 2008.
Virus epidemics causing uproar and panic among Internet users have long since passed. Nowadays malicious activities are less overt and in most cases remain unnoticed by inexperienced users. The July reaffirmed this tendency making “Trojan activity review” somewhat more appropriate title for this article for it is Trojans of all sorts that are brought in focus here.
Concerning Trojans
Trojans of the Virtumod family are the most interesting species from the point of view of analysis and working out a curing algorithm. Other anti-virus vendors classify them as Virtumonde/Vundo/Monder. By now these malicious programs have not paved their way to enter the glorious top ten spread malware but one can quite often come across with them in the wild. Very few anti-viruses can boast successful detection of such Trojans, let alone successfully cure them. The reason behind this complexity for anti-virus vendors is an operation algorithm employed by virus makers who are very consistent in the three or even four-way development of their polymorphic packer. Recent months saw over 10 modifications with dozens of thousands of samples for each type of the packer. The figures are based on data of other anti-virus vendors along with Dr.Web and also take into account samples found during an online virus scan.
Virtumod is not the sole active example of the off-line polymorphism. Now it is clear that without the centralized development of counteraction to this trend and without a versatile technology for prompt implementation of identifying of polymorphic packers in an anti-virus kernel the anti-virus industry may soon find itself inept in the face of emerging challenges.
Trojan.Clb is another malicious program spreading rather rapidly. It contains a rootkit and uses the splicing technology to hide files on disks and entire branches of the registry. Besides, there is also Trojan.DnsChange.967 that substitutes DNS server IP addresses on routers that support configuration via the web-interface. It imposes a real danger for users connected to wireless networks where the web-interface is typically used to configure routers. Users connecting to the Internet via a Wi-Fi access point can fall a victim of the DNS IP address substitution with their private data leaked to an unknown recipient.
Trojan.Okuks getting to a PC can also become a rather unpleasant surprise. Most anti-viruses have no problems detecting it. Meanwhile curing the malware is something entirely different. Incorrect curing of a system file infected by the Trojan or deletion of such a file without fixing the registry will get a Windows user a permanent BSOD after the first reboot.
The leaders
Actually there is only one leader that wanders up and down the top ten and seems to be reluctant to step down. Here we speak about worms belonging to the Autorunner family which are in abundance received by Doctor Web, Ltd. for the online virus scan.
Flash drives we got used to at home or in the office become the primary carrier for the worm. Virtually every user owns a flash drive. Employees carry data on flash drives on a business trip or take their work to their homes. However, along with the increased labour productivity the convenient storage device also imposes a threat because becoming one of the preferred means of spreading for viruses. But the most remarkable thing is that a flash drive is not the only USB device that can be compromised by the worm. It can get to a photo or a video camera or a mobile phone as easily. An Autoranner worm took the top notch in the anti-virus stats on the global infection level for servers protected by Dr.Web anti-viruses.
