April 2, 2009

Doctor Web presents a review of activities of malicious programs in March 2009. The last month saw increased usage of malware by online fraudsters, growing botnets with their creators applying more aggressive techniques to expand networks of zombie machines and spammers advertising their own business.

Botnets

New techniques introduced by virus makers to increase efficiency of Tdss and Shadow botnets made them main nuisances in March. Time-tested ways of spreading malware on removable data-storage devices and over network resources worked as well as before showing that most users didn’t follow security recommendations of anti-virus vendors.

On the other hand Doctor Web does its best to keep users and technical specialists updated on latest threats and provides them with Internet security tips. At the same time creators of botnets also know that certain vulnerabilities if open allow security experts and administrators to suggest that the system has been compromised. A new feature of Win32.HLLW.Shadow.based based enables it to close certain vulnerabilities in infected systems making it harder to detect if a system has been compromised.

The latest modification of Win32.HLLW.Shadow.based also features a domain name generator that uses a certain algorithm to generate 50 000 domain names every 24 hours and picks out 500 domains from the list to look for updates. Now it is much harder to disrupt operation of the botnet since one can’t find out addresses of all malicious servers and force their shutdown lawfully.

BackDoor.Tdss that expands the Tdss botnet uses other spreading and disguise techniques. Each subsequent version of the backdoor features more sophisticated rootkit technologies that allow it to evade detection and disrupt operation of anti-virus file monitors. To get into a system it exploits one of Windows vulnerabilities or can be downloaded and launched as a video codec by a user. Even though the codec trick has been known for quite a while it still remains efficient.

Cyber fraud

Once again an increased number of fraud schemes involving use of malware was registered in March.

Customers of sRussian banks using ATMs were worried by the news about viruses that compromised ATMs of certain Russian banks. The malicious programs collected information stored on credit cards and account information sent by the bank to the ATM upon a request of the customer.

The name of the program in the Dr.Web classification of malware is Trojan.Skimer. The Dr.Web virus database contains entries for ten modifications of the Trojan. It should be noted that banks received instruction on how to close the vulnerability from the manufacturer of ATMs before the Trojan was discovered by anti-virus vendors. See the detailed description of Trojan.Skimer in the virus library at the web-site of Doctor Web.

Even though anti-virus vendors provide detailed information about fake anti-viruses, cyber-criminals still implement schemes tricking users into paying for a program that actually does nothing. Now when elements of professional web-design are implemented on bogus web-sites spreading fake anti-viruses, the sites tend to look more and more like web-resources of real anti-virus vendors. Such fake anti-viruses as Antivirus XP 2008 are known to almost every Internet user.

Popularity of social networking web-sites in Russia provides virus makers with infinite opportunities. Another Trojan discovered in March was spread as a piece of software that would enable users of a social network to increase their rating.

Spam

The main subject of spam messages in the last month was advertisement of spam mailings. Probably the offer exceeded demand on the spam market. Apart from self-advertising spam messages also promoted healthcare products, expensive new mobile phones at great discounts and replicas of luxury watches. Some messages urged users to participate in conferences and take advantage of various training programmes.

Malicious programs or links to malicious web-sites provided by spam messages became smaller in number in recent months. Absence of mass spam mailings related to spread of malware caused different side-effects. Programs that usually didn’t spread via e-mail could get top positions in anti-virus statistics. It happened because users of compromised machines added infected files to attachments they sent via e-mail.

As for mailings that aimed to spread malware, virus analysts of Doctor Web registered a short-term mailing (several hours) of Win32.HLLW.Brutus.3 and a mailing of Trojan.PWS.Panda.114 that lasted a bit longer but used smaller amount of mail traffic. The latter came with a message supposedly from DHL. It informed a user that his message could not be delivered due to invalid delivery address. A user was offered to visit a DHL office with a printed invoice attached to the message. Of course the attached invoice was nothing more than a malicious file.

Even though the number of phishing messages in March was a bit lower than usual, virus analysts of Doctor Web registered several phishing attacks targeting customers of eBay.

Malicious files detected in mail traffic in March

Malicious files detected on user machines in March