Windows malware

After some analysis it seems that Sober.q hasn’t yet begun spreading, yet. Probably the author only wants the Worm to start spreading when enough computers have been infected with it.

We have just detected a new Email-Worm.Win32.Sober variant, we detect it as Sober.q.

Another malware anniversary

Sober.p currently is not spreading. After days of sending out emails, it’s now checking for updates at predefined locations, which indicates that more malware is likely to follow.

There’s recently been a great deal of talk about Windows for x86-64. One interesting feature of this operating system is that modifying the system structure is forbidden – this includes modifying:

The Bagle author keeps sending out new malware. Earlier today we saw a new Trojan-Proxy.Win32.Mitglieder variant, which is closely related to Bagle.

Last night we detected one new Bagle variant, this variant only had downloading capabilities and no massmailing functionality.

Today we detected a new variant of IM-Worm.Win32.Kelvir – we detect it as Kelvir.k. As always Kelvir is accompanied with an IRCBot, which we detect as Backdoor.Win32.Rbot.gen.

Kaspersky Lab presents the Virus Top Twenty for March 2005

Virus.MSAccess.AccessiV

Today we detected mass mailing of Trojan-Downloader.Win32.Small.anh in Russia

Automated mass mailing of malicious code

New Bagle.pac was found in-the-wild. This is another dropper (not a worm) but it was mass-spammed in Russia in last hour.

The SpamTool we detected on February 15 harvests emails on infected machines selectively. It turns out that it had been preparing today’s Bagle outbreak.

The first day of spring brought us five new Bagle variants within a few hours. We detect them as Email-Worm.win32.Bagle.bb-.bf