Ending on the eastern calendar year is considered the year of the bull. For cybercriminals "red rag" were money users - easy prey in an environment where people trustingly clicks on the link provided purportedly from friends, and download the program, "necessary" to address those or other problems. Creation of destructive malware in this case in the past. Requirements of money attackers displayed in the windows of various Internet browsers and on the desktop or above all windows in the system. As the vehicle for the spread of viruses have been used as the classical channels - email, instant messaging, and the new - social networks and blogs.
rootkits
Most puzzles for virus technology in 2009. The authors of new rootkits. These malicious programs hide its presence in the system, as well as the capabilities to hide from the eyes of the user, and the majority of antivirus mode other malicious programs they download from malicious web sites. There are cases when a rootkit components have been added to the virus database of any anti-virus, but it is, nevertheless, does not notice the presence of malware objects in the system.
The most notable malicious programs in this class was the family BackDoor.Tdss (the name is classified by Dr.Web). In March it was reported that a modification of BackDoor.Tdss prevents the file monitors included in the composition of some antivirus and anti-rootkits bypasses. While the prevalence of BackDoor.Tdss was relatively low.
In November 2009, a new modification BackDoor.Tdss spread much wider. Server statistics of "Doctor Web" in the past month were about 400 000 definitions of the malware on users' computers. Up to this point the figure rarely rose above the 1000 definitions in the month.
Interestingly, the new modifications BackDoor.Tdss were enhanced with advanced hiding technologies. For example, specially created and encrypted virtual drive mechanism for bypassing certain types of behavior analyzers. In spite of such "Doctor Web" in a short time we have solved this problem by providing the company's products to correctly treat BackDoor.Tdss.
Fake anti-viruses
In the last months of the year significantly increased proliferation activity of fake anti-viruses, which are classified by Dr.Web called Trojan.Fakealert. Such programs have looks like a real antivirus program, but they are not. The aim of the creators of fake anti-viruses - to entice the user to a bogus website where he has allegedly purchased the full version of the product.
Usually, fake anti-viruses spread as attachments to spam emails or over fraudulent sites. Thus most thus transmitted Rogue AVs loader which loads at startup with malicious server components constituting the basic functionality. The emphasis is on the visual part of this type of malware - software displays the Windows system window, which inform that the alleged anti-virus integrated into the system. The main window shows the computer's scanning and simulates the detection of viruses.
Once the user has paid the money for allegedly full version of this antivirus, his troubles did not end there - he is still "on the hook", and any other malicious objects can be loaded into the system.
Since September 2009, there has been a surge of activity Information threats - in October and November was recorded at several tens of millions of detections. Before September the total number of fake anti-viruses detected in a month on users' computers were as much as 4 orders of magnitude smaller.
Windows blockers
A lot of trouble in 2009 brought users and Windows blockers - malware that Dr.Web classification called Trojan.Winlock. These malicious programs when Windows starts output of all windows message that access to the system is locked, and to this window has disappeared, it is necessary to send a paid SMS.
The reason for blocking the program can inform that the computer has allegedly unlicensed operating system or other software (rarely used other "reasons"). There are cases Distribution designers malware database for a certain amount - to get them could be anyone.
Several years ago, malware Trojan.Winlock family were less harmful, in contrast to the modern copies are automatically deleted from your computer in a few hours after installation if the user has not done anything; not start Windows in Safe mode; system really unlock if you enter the correct line, and SMS messages cost was low.
Recent modifications Trojan.Winlock become more aggressive. SMS messages to unlock much more expensive. Some modifications may or may not contain the correct code to unlock it, and, accordingly, users paying attackers left with nothing. These programs are not automatically removed from after a certain time of the system. Trojan.Winlock learned to prevent the launch of many programs that can simplify the study blocker on the infected system or simply shut the system down if you try to run this software.
In the case of infection, the next modification Trojan.Winlock do not send money to the attacker. Instead, you should contact the technical support used antivirus or on the company's forum, "Doctor Web".
browser banners
Another modification of Trojans extortionists is the family of malicious programs, installed as an extension to a browser plugin. As a result, the installation window will appear, which can take up to half of the usable area of ​​the browser window. To remove the window you want to send a text message.
Dr.Web classification the bulk of such malware is defined as one of the modifications or Trojan.Blackmailer Trojan.BrowseBan. If Trojan.Blackmailer usually installed only in the browser Internet Explorer, then Trojan.BrowseBan can be installed in several different popular browsers - Internet Explorer, Mozilla Firefox and Opera. To do this, a malicious site from which the Trojan spreads, attackers create a script that allows detecting the browser and then providing him or her version of the Trojan.
In March 2009, it was seen a surge in activity of malicious programs of this type. Then it was fixed about 3 million. Trojan.Blackmailer determinations on users' computers. On average, during the year the number of definitions of malicious browser banner was kept at 5 000 - 10 000 per month.
Encrypting documents
Another problem faced by many users in 2009, became coders documents - malware, which are defined as a Dr.Web Antivirus various modifications Trojan.Encoder. This malicious program penetrating the system is encrypted using a certain algorithm user documents without affecting the files related to the operating system. After that, the desktop notification is displayed that the user data is encrypted, and to restore the attackers to be transferred a certain amount of money.
Razrvabotchiki antivirus faced with the facts of the use of its corporate attributes in the materials of one of the authors Trojan.Encoder. cases of spam messages on behalf of "Doctor Web" company employees were also recorded, and some modifications Trojan.Encoder used drweb additional extension for encrypted files.
Despite the relatively low prevalence of malware of this type, if it enters the system they cause substantial damage - because documents often have a high value to users. Victims of Trojan.Encoder can always consult the company "Doctor Web" in the virus laboratory - the vast majority of experts will help in the recovery of encrypted documents, with free.
worms
Worms in 2009 forced many administrators of local networks of enterprises to recall the basic information security rules. The brightest representative of these malicious programs has become worm Win32.HLLW.Shadow.based.
Firstly, the worm uses to spread removable media and network drives, recalling that under current conditions it is necessary to disable startup programs with these discs. Second, the program can use the default for the Windows SMB protocol-networks. However, it goes through a dictionary common passwords, reminding network administrators that these passwords must be difficult enough - after all of this depends on the functioning of the entire network. Finally, Win32.HLLW.Shadow.based uses several known vulnerabilities of Windows-systems. At the same time at the beginning of the active promotion Win32.HLLW.Shadow.based these vulnerabilities have already been closed by the manufacturer. This fact indicates that automatic installation of updates on your operating system will never be excessive loss of Internet traffic.
Active dissemination Win32.HLLW.Shadow.based continues today. This worm continues its kind, but very effective training of network administrators.
The variety of software environments
Some malware today is able to determine your operating system, browser, version of another popular software in order to more effectively strike system. But to ensure that this scheme has started to work, attackers need to learn how to create malicious software that can run on most popular operating systems. How are things going on that front?
If you look at the statistics of malicious programs for various platforms in 2009, we can draw the following conclusions. Interest in alternative platforms is constantly increasing. According to the statistics, for platforms such as Mac OS, Linux, Windows CE is not so obvious, but the news can often hear about the malware under these systems. But to mobile platforms such as Java (which is supported by many mobile devices) and Symbian interest is increasing every month. Even despite the fact that the proportion of malware definitions generally malicious traffic is still very small.
Projected trends in 2010
In 2010 we can expect the trend to single-step coverage malicious users the greatest possible number of operating systems and browsers. We can assume that will increase the number of malicious sites that will run scripts that are capable of detecting a programming environment and depending on it to boot the corresponding malware. The operating system market is gradually exfoliates -, new OS, new mobile devices, more and more people are interested in open source software, and virus writers will react to these trends to watch out for their own benefit.
It is expected that in subsequent years, attackers will devote more time to circumvent not only the classical signature-based and heuristic technologies, but also countering behavior blockers, examples of what we see today.
Surely the development will continue new rootkit technologies, and control will be as acute as in recent years. Probably in 2010 will be made the first attempts to create a rootkit for 64-bit Windows platforms. Many experts argue that it is only a matter of time. It is very likely increased use of polymorphic technologies that can easily hinder the work of the so-called cloud-based antivirus. If the spread of malicious programs, each unique in its copy will be a significant part of all malicious traffic, it can make use of such anti-virus technology is extremely inefficient.
Amount will be taken and the creators of malicious sites. Already, anti-phishing technologies used in any modern browser, and designed to protect users from visiting malicious sites, often can not cope with the task. Attackers quickly create too many copies of the same site, and anti-phishing systems simply do not have time to work on each of them.