New Mytobs, and generic detections

We’ve been seeing a lot of new Mytob variants recently. It’s less than three months since we added detection for Mytob.a and already we’re well into double figures. In the last day or so we’ve added detection for Mytob.au (and there’s a lot of Mytob.au out there!), Mytob.av and Mytob.aw. If it were not for generic signatures, there would be a lot more!

Generic detection lets us detect multiple variants of the same malware family using a single virus definition … sometimes tens or even hundreds of threats! The use of hundreds of unpackers within the Kaspersky® antivirus engine has the same effect: re-packed variants are often detected without the need for a new definition.

The down side is that the suffix used to identify some new threats may not match that used by other antivirus vendors. This is especially true for ‘successful’ threats that spawn large numbers of variants.