February 2, 2009

Doctor Web presents the virus activity review for January 2009. The first month of 2009 went rather smoothly except for the outbreak of Win32.HLLW.Shadow.based. It didn’t see mass mailings spreading malicious code in attachments or directing users to bogus web-sites. However, fraudulent SMS, fake anti-viruses, new Trojans turning user machines into botnet zombies as well as phishing attacks were registered every now and then.

Win32.HLLW.Shadow.based (Net-Worm.Win32.Kido, W32.Downadup, Worm:Win32/Conficker)

In January Doctor Web issued a warning about the outbreak of the Win32.HLLW.Shadow.based polymorphic worm. This malicious program showed once again that installation of critical updates for Windows and other software is a must for every user willing to maintain high security of the system. It is also recommended to disable the autorun for removable drives as it is exploited by Win32.HLLW.Shadow.based as well as by many other malicious programs. Strange as it seems but the epidemics may have a positive effect upon users learning to use stronger passwords for the Trojan attempts to crack an administrator password in order to spread over a local network.

Virus analysts of Doctor Web have been adding entries for new modifications of Win32.HLLW.Shadow.based into the virus database throughout the January. If you suspect that your system is infected with the polymorphic worm, install all critical updates for the version of Windows you use, disconnect the machine from the network and use Dr.Web CureIt! to scan your system. Computers running Dr.Web for Windows with its virus databases updated regularly are protected from attempts of Win32.HLLW.Shadow.based to get into the system.

E-cards

Even though the e-card disguise for malware has been well known for quite a while it remains as efficient as ever. In December 2008 and January 2009 numerous fake New Year and Christmas greeting notifications got in mailboxes of millions of users. As January drew to the end, web-sites supposedly providing Valentine greetings began to emerge. Trojan.Spambot is one of many malicious programs that get to user machines from such sites. Also known as Waledac the Trojan turns a compromised system into a zombie.

SMS-fraud

Criminals also attempted to get more money from accounts of subscribers of mobile operators. They used malware to encrypt data stored on a computer of a victim and demanded him to pay for their decryption. They could also demand money for removal of a malicious program installed as a browser plugin or lure a user into downloading and installing of a program on the phone that would start sending paid SMS. The malicious program is detected by Dr.Web as Java.SMSSend.19.

Fake anti-viruses

Fake anti-viruses also retained their popularity. Even if a program didn’t perform any malicious tasks in a compromised system it was still harmful as fraudsters received money for a useless piece of code. In January one of numerous web-sites offered online scanning of a system.

All machines that were checked for viruses by the “anti-virus” got infected. Moreover, when scanning was completed, a victim was offered to download another malicious program detected by Dr.Web as Trojan.Fakealert.3914.

Phishing

The number of phishing attacks was lower in January compared with previous months. Main targets of criminals in the last month were customers of amazon.ca and PayPal.

Malicious programs in e-mail traffic in January

Malicious programs on user machines in January