Top Ten viruses and spyware most frequently detected by ...

06/30/2005. As it does every month, Panda Software has published its ranking of the top ten viruses most frequently detected by its online anti-malware solution, Panda ActiveScan, in June (www.activescan.com). A new version of this tool which also detects spyware has recently been made available to users. Based on this feature, Panda Software has also published the top ten spyware programs most frequently detected last month.

Last month’s top ten ranking of the malware that have caused the most infections includes three worms, four Trojans, an exploit, a virus and a Visual Basic script. As in the previous two months, the most wide-spread infection is the exploit Mhtredir.gen. This exploit tries to take advantage of vulnerabilities that have not been fixed in the computer it attacks. In order to prevent this attack, it is essential to keep your computer updated. This month’s Top Ten has few differences compared to the May ranking, except for the entry of the DC variant of the Mitglieder Trojan, which spread widely (associated to anther Trojan known as Downloader.CYB) and two examples of malware related to online fraud.

The appearance the Citifraud.A Trojan and the Smitfraud.A virus in the ranking last month confirm the growing belief that that authors are looking to earn an income out of their actions. Smitfraud.A is a component of an adware program of the same name that intercepts all the information sent from the browser, logging users browsing habits and even downloading and running an alleged spyware program on the computer in order to blackmail the user into buying the solution. The objective of Citifraud.A is to steal users’ banking details, a phenomenon called phishing. To achieve this aim, this malware uses an HTML file that contains a link to a malicious web page, which is an imitation of the real bank’s page. By exploiting a vulnerability in Internet Explorer, this malware can falsify the address displayed in the address bar of the browser, pretending to be that of the real bank.

Another tool designed to make money is bots, which appear in this ranking in the form of Gaobot and SDBot.ftp (a script for a bot of the same name). This type of malware is used to open backdoors in the computers it affects by exploiting vulnerabilities and waiting for commands, often through IRC applications. This allows it to call networks of bots set up so that this type of malware can be used to carry out coordinated attacks, send out advertising, spam, etc. and which are “hired out” by their creators.

Another malicious code that can be highlighted is the Netsky.P worm, which although it appeared over a year ago is still maintaining a high infection rate. This worm exploits vulnerabilities, including a flaw that allows it to run attachments when the message carrying it is viewed in the preview pane of the mail client. To keep this type of malware out of your computer, it is important not to open any attachments unless they come from a completely trustworthy source, and even then, delete messages that are not the usual style of the sender (messages in foreign languages, strange topics, etc.).

The full ranking of viruses, worms and Trojans is the following:

Malware                           % of infections
Exploit/Mhtredir.gen                 2.64
W32/Sdbot.ftp                          2.23
W32/Netsky.P.worm                  2.14
Trj/Qhost.gen                            2.13
W32/Gaobot.gen.worm             1.25
VBS/Psyme.C                            1.11
Trj/Small.GV                              1.08
Trj/Mitglieder.DC                       1.01
Trj/Citifraud.A                            0.87
W32/Smitfraud.A                       0.85

As well as this list, a separate ranking of infections by spyware is also generated. Spyware is a type of malware designed to gather data regarding users Internet habits and preferences, which is then sent to the creators of the malware or sold on to third-parties, normally spammers.

The classification of the most widespread spyware over the last month is as follows:

Spyware                            % of infections
Spyware/ISTbar                        3.48
Spyware/Cydoor                       3.1
Spyware/New.net                     2.88
Spyware/XXXToolbar                2.48
Spyware/Dyfuca                       0.95
Spyware/BetterInet                 0.82
Spyware/Petro-Line                 0.77
Spyware/Altnet                        0.67
Spyware/BargainBuddy           0.67
Spyware/MarketScore              0.51

As in the previous edition of this ranking, the spyware program that has been most frequently detect is ISTbar. This spyware program acts as an entry-point for other malware, as it is installed on victims’ computers camouflaged as an ActiveX control and, in turn, installs other similar types of malware: spyware, adware and dialers. It also displays pornographic pop-ups, installs a toolbar, and changes the browser home page. The entries in this ranking have remained stable since last month, except for MarketScore, a new spyware program that monitors users’ Internet activity to send it to online to advertising companies for online media.

To help as many users as possible keep their systems virus free, Panda Software offers its free online anti-malware solution, Panda ActiveScan, free of charge, at http://www.activescan.com, which now also detects spyware. Webmasters who would like to include ActiveScan on their websites can get the HTML code, free of charges, at http://www.pandasoftware.com/partners/webmasters.

Panda Software also offers users Virus Alerts, an e-bulletin in English and Spanish that gives immediate warning of the emergence of potentially dangerous malicious code. To receive Virus Alerts just visit Panda Software´s website (http://www.pandasoftware.com/about/subscriptions/) and complete the corresponding form.

For more information about these and other malicious code, visit Panda Software´s Virus Encyclopedia.

About PandaLabs

On receiving a possibly infected file, Panda Software´s technical staff get straight down to work. The file is analyzed and depending on the type, the action taken may include: disassembly, macro scanning, code analysis etc. If the file does in fact contain a new virus, the disinfection and detection routines are prepared and quickly distributed to users.
For more information: http://www.pandasoftware.com/virus_info/

Oxygen3 24h-365d, by Panda Software
© Panda Software 2003

2005-07-02 17:46

Back

IT News: