Top20 Blocked Malware

The Top 20 malicious programs blocked on PCs  

June sees minor changes in the top positions compared to the previous month: Virus.Win32.Neshta.a and Trojan.Win32.Jpgiframe families which appeared in the Top 20 malicious programs in March continue to appear in the current Top 20. Several new families entered the Top 20 in June.

Trojan-Clicker.HTML.Iframe is designed to increase site visitor statistics. The Trojan programs themselves are contained in fake HTML pages with encrypted links to the sites being promoted. When users unknowingly surf to an infected page,  unsolicited connections are made to certain URLs, fraudulently generating revenue for the attacker.

MSIL.Backdoor.Agent. Backdoors give an attacker remote unauthorized access to the infected system. This backdoor is written in .Net. Thus, computers with .NET Framework installed are infected.

INF.Autorun. INF files are used by Microsoft Windows to automatically run or install applications. An attacker stores inf files in the root directory of the logical, portable and network drives together with the worm’s executive files. This activates the worm each time a user opens the infected disk using Windows Explorer.

New Incomings to the Lab

Let’s review and consider information on the number of unique files with the same detection name.

 New malicious programs entered the Top 20

A new generic detect Trojan.Win32.Generic.pak!cobra has entered the Top 20. The top positions are still occupied by viruses and generic detects as the majority of signatures belong to these categories. Let’s consider some of them.

Virus.Win32.Xpaj.A infects x86 pe-exe and pe-dll files. In addition, the virus contains backdoor and bootkit-like behavior. It uses a special technique to counteract antivirus applications. The virus installs system notifiers to create processes using the PsCreateProcessNorifyRoutine functions. Thus, the antivirus is blocked. Once the process runs on the system, the virus calculates checksum of the process name and compares it with its internal checksum list. If the checksum of the name coincides with the list inside of the virus body, it inserts a code to the Entry Point which ends the process.

To hide a bootkit and its data in the last sections of the drive, the virus intercepts the NTReadFile and NTWriteFile functions.

Diagnosing the system for the installed interceptors and MBR infection using the Gmer anti-rootkit

A peculiarity of the virus lies in the ability to run on the Windows x64 when Kernel Patch Protection (KPP) known as “PatchGuard” is on. KPP protects infected MBR from being read and modified.

Trojan.Win32.Carberp (Trojan.Win32.Generic.pak!cobra) is used by an attacker to steal confidential data from trade and online banking platforms. The latest versions of the Trojan contain bootkit-like features. The Trojan supports a plugin system. Plugins are used to counteract antivirus products, rival’s botnets, to perform DdoS attacks and steal confidential data. Below is an example of how the bankbot is sold on blackhat forums:

Offer for Multifunctional Carberp Bankbot

According to the latest news from ESET, all botnet creators have been arrested.

Backdoor.Win32.Shiz (Trojan.Win32.Generic!BT) has a wide range of features. A peculiarity of this malicious program lies in counteracting antivirus detections using server-side polymorphism. A polymorphic mutator engine is installed on the attacker’s server and updates itself periodically:

Comparison of two modifications of Backdoor.Win32.Shiz

Worm.LNK.Autorun.bqj uses vulnerability in Lnk-files. Attackers continue to exploit a vulnerability discovered in June 2010 when investigating Stuxnet. In spite of MS10-046 updates issued by Microsoft which closes the vulnerability, LNK files which exploit this vulnerability increase in number:

Received LNK samples

Top20 Potentially Unwanted Programs

Below is Top20 Potentially Unwanted Programs blocked by Ad-Aware on user’s PCs. These are advertising software, browser toolbars, search engines and other programs which change browser start pages and other system settings.

Top20 PUPs detected on user’s PC

Operating Systems

Infections by OS

Geographic Location

Infections by country of origin

We will keep investigating the epidemiological situation in the world and informing our readers about new malicious code samples in the next Lavasoft Security Bulletin.