Doctor Web presents a virus activity review for September 2008.

Doctor Web presents you a virus activity review for September 2008.

The first autumn month brought quite a lot of nuissances to PC users, such as new encrypting Trojans, mass-mailings with URLs to malicious codes, and fake “anti-viruses”. Specialists of the technical support of Doctor Web on a round o’clock bases helped customers and virus analytics from the Dr.Web anti-virus laboratory perfected counteracting techniques against new ill-intentions codes. Some of them will be described below.

At the beginning of the month two new modifications of the extortion Trojan appeared. The program encrypts documents on the victim computers and claims a redemption fee. Earlier Doctor Web reported on the Trojan in the news about Trojan.Encoder.20 and Trojan.Encoder.21. The company developers promptly reacted on a new threat and quickly designed and offered to customers a free deciphering utility.

It should be noted, that new modifications of this Trojan are being distributed more intensively now than before. After all documents on a victim computer are encrypted, a virus displays a picture (see below) on the Desktop and offers to read a txt-file where the procedure of how and where to pay to the Trojan`s author for the decryption is detailed.

Speaking on the extortion-programs, a malicious plugin for Internet Explorer should be mentioned here as well, especially because the number of the support requests from customers infected with it increased dramatically lately. Plugin appears in Internet Explorer and covers the most part of the screen. The malware demands from a user to send an SMS-message from a mobile phone in order to receive instructions on uninstallation. Below you can see how such plugin is displayed in a browser. Virus analytics from the anti-virus laboratory of Doctor Web labeled this malware as Trojan.Blackmailer. A special entry for Trojan.Blackmailer.origin was also added to Dr.Web virus database. This single entry helps to remove from an infected system numerous modifications of the extortion-plugin.

Fake “anti-viruses” became a topical issue in September. Such programs install themselves in a system and display a message allegedly claiming a “virus” is detected. To remove it from a system a user is offered to make some actions, for example, to download full version of this “anti-virus” program. The virus disables some panes of the standard Windows window and changing of images on the Desktop becomes impossible as fake alerts on “infection” are displayed using such images. See example of such message below. Dr.Web classified this virus as Trojan.Fakealert.

Concerning spam, the most noted spam distributions of this month contained URLs as if with erotic movies of famous stars, but in fact the movies turned out to be Trojan programs detected by Dr.Web Trojan.DownLoad.4419. The Trojs quite often change packers and the content and up to several modifications a day can appear. Several special entries are added to Dr.Web virus base to detect the Trojans of this category – Trojan.Packed.628, Trojan.Packed.642 and Trojan.Packed.648. See below the example of such spam message.

As usually, URLs in spam distributions of September pretended to point to well-known sites, but actually led to fake web-pages. One should always be attentive and check carefully what web-site is really opened in the browser, if the link in the spam message is hit, as in most cases such spam messages allure users to advertising web-sites. In the two examples below the first one imitates a message of a Google AdWords support team – a Google`s advertising service. The other one demonstrates a fake message as if sent by the customer support service of the famous Russian social network Odnoklassniki.ru.

”Storm” messages did not leave the Internet in September. They propagated as a message by some TV-company with an URL to a fake movie about some fabricated story. To run the movie, a user is offered to download a codec program which is one of the variants of Trojan.DownLoad in the Dr.Web classification.

In September a number of spam distributions with file attachments increased. As a rule, they contained ZIP-archived executables. Such messages usually contained a brief statement inciting a user to open the enclosure. In some cases it was a debt history report to be redeemed ASAP, or a warning on disabling the access to the Internet with a user`s illegal activity, as well as other tricks. These attachments are detected by Dr.Web as a modification of Trojan.Inject or Tro-jan.PWS.GoldSpy.

Another quite a notable spam distribution contained a price-list packed with ZIP, as if ordered by a customer. Being opened, the document looked as a pure spam message, but in fact it contained an automatically launched macro. The macro restored an executable, wrote it into a temporary folder and executed it. The restored executable is detected by Dr.Web as Trojan.EmailSpy.136. The malware collects info on e-mails stored in a computer and sends these e-mails to the virus writer. The e-mails are used to distribute spam.

Quite a big torrent of e-cards circulated on the Net in September. These are small text message with an URL pointing to a file named e-card.exe (see example below). Being executed, such files lunch not one but several malicious programs. One of such examples is the Trojan classified by Dr.Web as Trojan.MulDrop.19265. After execution it installs into a system three malicious Trojs – Trojan.MulDrop.19266, Trojan.Siggen.252 and Trojan.Sentinel.based. Almost every distribution of such Trojans is unique and viruses in a set are never repeated.

An increasing popularity of the AutoIt programming language is one of the tendencies of September. This language is more and more used to write virus programs. It is an open source language and is used to automate tasks in Windows. Its latest versions are abundant with different options (TCP\ UDP connection, inclusion of files into a compiled file, which can further be extracted at a launch, an option to log keyboard buttons, etc.). All this, as well as ease of use, attracts attention of numerous virus-makers.

The most mass-mailing distributions in September contained malicious codes of Win32.HLLW.Autoruner.2640 and Trojan.Recycle.

On the whole, the virus situation in September did not differ much of that in August. Doctor Web, as always, warns users to never transfer funds to authors of Trojans and never fall into traps of social engineering techniques used by them. If you experience a suspicious activity on your computer, contact technical support service of Doctor Web.

Viruses detected in e-mail traffic

Viruses detected on workstations