Windows malware

Using malware for extortion: striking, but not new!

It’s less than three months since we added detection for Mytob.a and already we’re well into double figures.

After some analysis it seems that Sober.q hasn’t yet begun spreading, yet. Probably the author only wants the Worm to start spreading when enough computers have been infected with it.

We have just detected a new Email-Worm.Win32.Sober variant, we detect it as Sober.q.

Another malware anniversary

Sober.p currently is not spreading. After days of sending out emails, it’s now checking for updates at predefined locations, which indicates that more malware is likely to follow.

There’s recently been a great deal of talk about Windows for x86-64. One interesting feature of this operating system is that modifying the system structure is forbidden – this includes modifying:

The Bagle author keeps sending out new malware. Earlier today we saw a new Trojan-Proxy.Win32.Mitglieder variant, which is closely related to Bagle.

Last night we detected one new Bagle variant, this variant only had downloading capabilities and no massmailing functionality.

Today we detected a new variant of IM-Worm.Win32.Kelvir – we detect it as Kelvir.k. As always Kelvir is accompanied with an IRCBot, which we detect as Backdoor.Win32.Rbot.gen.

Kaspersky Lab presents the Virus Top Twenty for March 2005

Virus.MSAccess.AccessiV

Today we detected mass mailing of Trojan-Downloader.Win32.Small.anh in Russia

Automated mass mailing of malicious code

New Bagle.pac was found in-the-wild. This is another dropper (not a worm) but it was mass-spammed in Russia in last hour.