Though short, February saw quite a number of viral threats. Along with traditional and online fake anti-viruses in the spotlight, new extortion schemes involving mobile devices appeared, while the proportions of the Windows blockers epidemic declined.

Windows blockers

Joint efforts of Doctor Web, law enforcement organizations, telecom operators, short number aggregators and wide public awareness of the Trojan.Winlock problem allowed reducing the number of infected machines to figures comparable to the number registered when the epidemics began in November 2009. While in January the number of detections of Trojan.Winlock registeredper day could exceed 100 000, in February the figure dropped to several thousands per twenty-four hours.

In spite of the sharp decline, dozens of thousands of users in Russia and Ukraine fall victims of the Trojan on a daily basis.

In the last two weeks of February a new browser blocking extortion scheme became widely popular. Going to a malicious web-page brought up a pop-up window that wouldn’t close unless an “activation code” was entered. The code is provided for a paid SMS. Even though this problem can be solved quite easily (stop the browser process using the task manager or force a system reboot), the number of people fallen victims of this scheme still increases among users of Windows as well as among people that use Mac OS.

Fake anti-viruses

In February cyber-criminals more often resorted to fraud schemes involving sites promoting fake anti-viruses to Internet users from Russian and other CIS countries. Links to such sites are spread over e-mail, compromised ICQ accounts and using contextual advertising on web search results pages and in social networks. Access to such web-sites is blocked by the Dr.Web Parental control.

Along with online fake anti-viruses Russian users were sometimes offered a customary Trojan.Fakealert. In such cases they were persuaded to download and install a fake anti-virus that imitated a scanning procedure and after that offered a user to send a paid short message.

Even though Trojan.Fakealert target group included Russian-speaking users, the highest number of victims of the fraud was found among speakers of English. Trojan.Fakealert offers a victim to pay 50 U.S. dollars for the fake anti-virus with a credit card. The offer to purchase a full version of the supposed anti-virus can be displayed in a browser window as well as using the fake anti-virus’s interface. Statistics regarding Trojan.Fakealert for the last six months shows a rapid growth in number of samples of the malware found in the wild started in October 2009. Doctor Web’s statistics server registers a huge number of detections of fake anti-viruses by Dr.Web solutions every 24 hours. And the top 20 of most widely spread malicious programs in February included 8 modifications of Trojan.Fakealert.

New Internet fraud scheme

A new fraud scheme used for money laundering lures users into giving away their mobile phone numbers in order to subscribe to a certain service. An SMS reply provides a would-be subscriber with an activation code where the contents usually have nothing to do with the topic to which the web-site is related. By entering the code a user signs up for a service. The service fee is debited from the user’s account on a daily basis without any warning. The withdrawn amount is small, so a user may fail to notice that something is wrong right away. Besides, terminating such a subscription may be difficult and require a paid SMS to be sent.

The number of malicious programs in e-mail traffic increased four times in February compared to the previous month. This dramatic surge was mainly caused by a growing number of fake anti-viruses and their downloaders in e-mail attachments. The number of malicious files among all files scanned on user machines increased by 24% in February thus reaching the figure registered in December 2009.

Malicious programs detected in mail traffic in February

Malicious programs detected on user machines in February