Windows malware

My colleague Jorge Mieres recently found a C&C server of a botnet based on a malicious program called Ice IX

After rumors about the supposed merger between SpyEye and ZeuS, and the public release of the source of the latter, it was logical that the range of possibilities opened up even more for new cybercriminals into the ecosystem of crimeware.

Scar is a basic peer-to-peer botnet that serves as a distribution channel for installing other bad stuff.

In 2010 we noted a decline in the number of players in the fake antivirus market, and as a result, fewer counterfeit programs used to distribute fake antivirus products

Attacks registering a remote user account called ‘Remo’ which is password-protected allow Brazilian cybercriminals to have total access and control over infected machines.

Modification of the hard drive areas responsible for the initial loading of the system has become increasing popular with cybercriminals.

The recent online hysteria over the BitCoin virtual money system has attracted the attention not only of those who dream of making money out of thin air but also of cybercriminals who, as usual, want to steal anything they can get their hands on.

The following statistics were compiled in May using data from computers running Kaspersky Lab products 242,663,383 network attacks blocked.

In the last few days experts at Kaspersky Lab have detected new samples of the malicious program MAX++ (aka ZeroAccess). Back then, MAX++ only worked on x86 platforms; now it is capable of functioning on x64 systems!

A host of events took place in the world of IT threats during the first quarter of 2011.

The following statistics were compiled in April using data from computers running Kaspersky Lab products: 221 mln network attacks blocked,190 mln malicious programs detected, 86 mln heuristic verdicts registered.

The Artro botnet has been around since early 2008. However, a full description of its functionality is still not available, so to rectify this, we decided to publish the results of a study we undertook.

We recently discovered a new bootkit, i.e. a malicious program which infects the hard drive’s boot sector. Kaspersky Lab detects it as Rookit.Win32.Fisp.a.

We found a new malicious application that disguises itself as a Kaspersky Trial Resetter (an application that can be used to reset a software evaluation period that has expired).

A trojan called Bohu that was spreading earlier this year caught people’s attention. Amongst other things, Bohu also prevents access to a Kaspersky server – which can be turned into an online infection check.