Doctor Web, Ltd. – the Russian developer of IT security solutions branded Dr.Web – provides the review of virus and spam activity in May 2008

The top event of May surely became the discovery of the elusive Win32.Ntldrbot (aka Rustock.C) by the anti-virus laboratory of Doctor Web, Ltd. The long sought rootkit used infected machines to build a vast botnet. Secure Works consider the botnet to be the third among largest botnets with spamming capability of up to 30 billion messages in 24 hours. Computers protected by the Dr.Web anti-virus will never become the part of the network because the new version of Dr.Web scanner detects the stealthy virus as well as cures an infected machine of the malware. It’s been a month since the cure against Win32.Ntldrbot was provided but by now Dr.Web is still the only anti-virus that cures the rookit.

Another notable event in the month passed became the increased malicious activity faking and manipulating search results to infect PCs. A user of an infected machine follows a link displayed on a search results page but gets to an unrelated web-site. Still the unrelated link can look as other genuine links provided by a search engine. As a consequence a user fails to find required information, an advertiser pays for unrelated traffic but above all such malicious activities have negative impact on the credibility of a search engine blamed for selling out top positions on its search results pages. Upon a request from the management of the Yandex search engine malicious programs of the type were moved from Adware to Trojans in the Dr.Web classification. Currently Yandex recommends Dr.Web CuireIt! as the best free tool curing computers of such Trojan programs.

Spam activity

Spam traffic often spreads viruses, Trojans and other malware. Recently spammers have been exploiting popular Internet brands of the RuNet. Socail networks have a lot of members and inevitably become primary targets of spammers. Such an attack can get a computer of a social networker into a botnet or put a user at risk of losing all information stored on the hard drive. The latter was the case with Win32.HLLW.AntiDurov. What makes the virus especially dangerous is its destructive feature which is rather uncommon among present day malware. On 25th day of each month at 10 a. m.deletion of all files located on the C drive is initiated. It’s been a while since Doctor Web, Ltd. virus monitoring service registered malware with such functions.

Table 1. Top 10 viruses detected on mail servers

Table 2. Top 10 viruses detected on PCs