Kaspersky Lab Presents Its Monthly Malware Statistics For August 2009

04 Sep 2009
Virus News

Kaspersky Lab, a leading developer of Internet threat management solutions that protect against all forms of malicious software including viruses, spyware, hackers and spam, has released two malware ratings compiled from data generated by the Kaspersky Security Network (KSN) in August 2009.

The first Top Twenty list malicious programs, adware and potentially unwanted programs that were detected and neutralised when accessed for the first time, i.e. by using the on-access scanner.

PositionChange in positionNameNumber of infected computers
1  0Net-Worm.Win32.Kido.ih  48281  
2  0Virus.Win32.Sality.aa  23156  
3  Newnot-a-virus:AdWare.Win32.Boran.z  16872  
4  -1Trojan-Downloader.Win32.VB.eql  8030  
5  -1Trojan.Win32.Autoit.ci  7846  
6  0Virus.Win32.Virut.ce  6248  
7  -2Worm.Win32.AutoRun.dui  5516  
8  0Net-Worm.Win32.Kido.jq  5446  
9  -2Virus.Win32.Sality.z  5157  
10  NewVirus.Win32.Induc.a  4476  
11  -2Worm.Win32.Mabezat.b  3982  
12  -2Net-Worm.Win32.Kido.ix  3579  
13  -1Packed.Win32.Klone.bj  3579  
14  NewTrojan.Win32.Swizzor.b  3327  
15  NewPacked.Win32.Katusha.b  3139  
16  -2Worm.Win32.AutoIt.i  3076  
17  1not-a-virus:AdWare.Win32.Shopper.v  2947  
18  NewTrojan-Dropper.Win32.Flystud.yo  2745  
19  -2Email-Worm.Win32.Brontok.q  2706  
20  NewP2P-Worm.Win32.Palevo.jaj  2664  

Net-Worm.Win32.Kido.ih and Virus.Win32.Sality.aa, our two long-standing leaders, are still at the top of the rating. There are six newcomers to this month’s Top Twenty and some of them deserve a special mention.

By far the most interesting is Virus.Win32.Induc.a, which Kaspersky Lab has written about a number of times in recent weeks (news and weblog). To recap: in order to replicate, Virus.Win32.Induc.a makes use of the fact that Delphi has a two stage method for creating executable files - the application source code is first compiled into intermediate DCU modules which are then assembled into Windows executable files. Software products compiled on machines which had infected versions of Delphi were consequently infected with the virus when they were compiled; as there were a lot of these products, it's no surprise that Induc went straight into tenth place.

Another newcomer, not-a-virus:AdWare.Win32.Boran.z, entered the ratings even higher, coming straight in at third place. This program is a component of the Baidu Toolbar for Internet Explorer, which is popular in China. It uses a range of rootkit technologies to prevent users from removing the toolbar using standard methods.

Trojan.Win32.Swizzor.b and Packed.Win32.Katusha.b claimed 14th and 15th positions respectively. These two replace earlier versions of the same programs which previously figured in our ratings. In comparison to the previous versions, both these programs use very sophisticated and innovative obfuscation methods.

Palevo.jaj took last place in the Top Twenty, taking over from its relative P2P-Worm.Win32.Palevo.ddm that emerged back in May. As this version of Palevo spreads via file exchange networks, infects removable media, can also be spread by IM, and includes a backdoor which gives an attacker the ability to control infected computers, this malware poses quite a threat.

Overall, the appearance of Virus.Win32.Induc was the highlight of the month, as this malware does use a truly innovative approach to infecting users’ computers.

Overall, there were no significant changes to the first Top Twenty in August, unlike our second Top Twenty.

The second Top Twenty presents data generated by the web antivirus component, and reflects the online threat landscape. This ranking includes malicious programs detected on web pages and malware is downloaded to victim machines from web pages.

PositionChange in positionNameNumber of infected web pages
1  Newnot-a-virus:AdWare.Win32.Boran.z  16760  
2  1Trojan-Downloader.HTML.IFrame.sz  5228  
3  NewTrojan.JS.Redirector.l  4693  
4  -3Trojan-Downloader.JS.Gumblar.a  4608  
5  NewTrojan-Clicker.HTML.Agent.w  4564  
6  NewExploit.JS.DirektShow.k  4475  
7  0Trojan-GameThief.Win32.Magania.biht  4416  
8  -4Trojan-Downloader.JS.LuckySploit.q  3416  
9  -7Trojan-Clicker.HTML.IFrame.kr  3323  
10  -4Trojan-Downloader.JS.Major.c  2688  
11  NewExploit.JS.Sheat.c  2684  
12  NewTrojan-Downloader.JS.FraudLoad.d  2553  
13  -4Trojan-Clicker.HTML.IFrame.mq  2367  
14  -3Trojan.JS.Agent.aat  2246  
15  -3Exploit.JS.DirektShow.j  2128  
16  NewTrojan-Downloader.JS.IstBar.bh  1973  
17  NewTrojan-Downloader.JS.Iframe.bmu  1933  
18  NewExploit.JS.DirektShow.l  1838  
19  NewExploit.JS.DirektShow.q  1753  
20  NewTrojan-Downloader.Win32.Agent.ckwd  1504  

More than half the entries in August’s second Top Twenty are new examples of cybercriminals' creativity. AdWare.Win32.Boran.z, which has already been described, took first place in this rating. A month ago Kaspersky Lab wrote about a vulnerability in Internet Explorer. The script that exploits this vulnerability is detected by Kaspersky Lab products as Exploit.JS.DirektShow. The July Top Twenty included three modifications of this exploit: .a, .j and .o. This month, there are four versions in the rankings, showing that exploiting this vulnerability is apparently still a very popular approach. It seems that cybercriminals assume that lots of users won't have installed the security patch, and so they keep trying to attack systems via this loophole.

Another vulnerability, this time in Microsoft Office, was also actively exploited by cybercriminals in August. One modification of an exploit for this vulnerability – Exploit.JS.Sheat - took 11th place in the rating.

Fake, or rogue antivirus applications are spread from a number of web pages and one of the scripts that facilitates this took 12th place in the rating. Kaspersky Anti-Virus detects it as Trojan-Downloader.JS.FraudLoad.d. If a user visits a website infected with this script, they are notified that their computer is infected with lots of malicious programs and that these programs can be removed. If the user agrees to this, a rogue antivirus (classified as FraudTool) is then downloaded to their computer.

The Trojan Redirector.l works by redirecting user search requests to specific servers in order to increase the hit rate for these servers. The Trojan-Downloader program Iframe.bmu is a typical example of malware which contains a range of different exploits, in this case exploits for Adobe products.

The trends seen in July are continuing, with cybercriminals still actively exploiting vulnerabilities in popular software products. Rogue antivirus applications and basic iframe-clickers are also spreading fast. It's unlikely that this situation will change next month, as cybercriminals have tried and tested these approaches and found them to be successful.

Countries where most attempts to infect computers via the web were recorded: