July 1, 2008

Concerning viruses

The increased spreading of a dangerous file virus classified by Dr.Web as Win32.Sector.5 (aka Sality) is not something to be omitted. The number of requests to the helpdesk from system administrators regarding malicious activates of the virus turned out to be so large that one could call it as much as an epidemics. As stated by those affected by the malware the present modification of Sector started causing problems in February this year. By now the epidemics has escalated and reached an astounding level. Banks, audit companies, retail chains, software developers, engineering companies, research facilities and federal cultural institutions were affected by activities of the file virus.

First samples of the sector family appeared in early 2003. In five years the malware mutated but retained its destructive capabilities and acquired new ones. Each subsequent variant of the virus tended to be less overt concerning its presence in the system. Experts of Doctor Web, Ltd. anti-virus laboratory think that the mutation provides an evidence that Win32.Sector.5 may now be used to hide other less complex but equally malicious programs stealing sensitive information or sending out spam.

As soon as Win32.Sector.5 gets into a system it injects its code in all processes currently present in RAM and removes certain branches of the system registry so booting in the safe mode becomes impossible. After that the file virus infects all .exe and .scr files on all available disks or network resources. In order to spread faster it also infects autoarun and most frequently launched files. Besides, Win32.Sector.deletes files and processes related to most known anti-virus programs and blocks access to web-sites of the anti-virus vendors preventing updating. Unlike other anti-viruses that either block access to an infected file or delete it, Dr.Web cures files infected by the file virus. The malware is not a threat to users of Dr.Web anti-virus performing regular updates of the virus database. If you are using some other anti-virus but for some reason you believe that your computer may be infected by Win32.Sector.5, you can check your system using the free curing utility called Dr.Web CureIt!.

On Trojans

The news of another modification of an encoder family Trojan –Trojan.Encoder.18 (aka Gpcode) – stirred the Internet at the beginning of June. Having infiltrated into the system the Trojan searches for files with certain extensions (typically Micosoft Office files) and encrypts the data. After that an owner of the files is offered to pay for decryption. Restoring data after activities of this malware is somewhat complicated for the malefactor uses 1024 bit long encryption key. Users of Dr.Web had been protected against Trojan.Encoder.18 even before a sample entered the virus database. The unique Origins Tracing™ technology allowed detecting the malware as Trojan.Sespy.origin.

In the previous year when the author of the Trojan used shorter keys for encryption it was pretty obvious that eventually it would become more complex. Meanwhile, some anti-virus vendors rushed to boast their decryption capabilities even though it was clear that they were bound to lose this sort of contest. Sooner or later the key would get long enough to set the decryption time frame beyond the boundaries of reason. Anti-virus experts of Doctor Web, Ltd. focused on prompt detection of the dangerous program so it would not be able to put to use its destructive capabilities. This approach turned out to be more efficient than rasing a worldwide call for decryption of a kilobit RSA key.

Curious

Surely a contact entry with the UIN 12111 that caused panic among users of ICQ instant messaging service became quite an incident. The technical support service of Doctor Web, Ltd. received lots of questions from users concerned about the “viral” contact list entry even though a contact entry itself could not do any harm. The turmoil calmed down only when the 12111 entry was explained at the ICQ web-site.

A few words about spam

In June spam tended to become smaller and shorter. Messages with a catchy subject line and a link supplemented with a brief comment in the body were sent in ten waves. Links become one of the common ways to evade spam filters. Besides the trick can also be dangerous as a provided link can direct to an infected web-page so a user can get a Trojan along with the content. Doctor Web, Ltd. described one of such mailings in the previous month. The virus monitoring service registered over 50 mailing like this. Many of them lasted for quite a while.

Dr.Web AV-Desk virus top 20

June virus top 20 in e-mail