GFI Software Announces Top 10 Malware Threats for August

(BUSINESS WIRE)--GFI Software, a leading IT solutions provider for small and medium-sized enterprises, today announced the top 10 most prevalent malware threats for the month of August 2010. The report, compiled from monthly scans performed by GFI's award-winning anti-malware solution, VIPRE® Antivirus, and its antispyware tool, CounterSpy®, is a service of GFI Labs™.

“Our research group is analyzing new rogues too, but what we’re seeing through ThreatNet indicates that VIPRE is preventing these rogue downloads.”

GFI VIPRE ThreatNet™ statistics for the month of August show that GFI customers were under attack throughout the month primarily by the same Trojan horse programs that have persisted for several months. In fact, the top four threats were unchanged in order from the month of July. Trojans detected as Trojan.Win32.Generic!BT were still the chief detection, slightly down to 25.11 percent of total detections. This particular Trojan detection has been in the top spot for some time: in July with 29.08 percent and in June with 27.16 percent of the total detections.

The number two detection, Trojan-Spy.Win32.Zbot.gen is a detection of password-stealing Trojans with many versions. The third largest detection, Trojan.Win32.Generic.pak!cobra, is a generic detection for a variety of malware that can infect 32- and 64-bit Windows installations.

“Detections of this malicious code indicate that botnet operators continue to try to infect machines and use them in their spamming networks,” said Francis Montesino, manager of the malware processing team, GFI Labs. “Our ThreatNet detections for the month also agree with other reports we’ve heard in the last few weeks that have found a high level of traffic in rogue security products. These are often referred to as scareware. We’re seeing a multitude of detections of the downloaders and installers that are associated with the rogues.

Montesino continued, “Our research group is analyzing new rogues too, but what we’re seeing through ThreatNet indicates that VIPRE is preventing these rogue downloads.”

The top 10 results represent the number of times a particular malware infection was detected during VIPRE and CounterSpy scans that report back to ThreatNet, GFI’s community of opt-in users. These threats are classified as moderate to severe based on method of installation among other criteria established by GFI Labs. The majority of these threats propagate through stealth installations or social engineering.

The top 10 most prevalent malware threats for the month of August are:
1. Trojan.Win32.Generic!BT 25.11%

2. Trojan-Spy.Win32.Zbot.gen 4.23%

3. Trojan.Win32.Generic.pak!cobra 3.61%

4. INF.Autorun (v) 3.27%

5. Trojan.Win32.Generic!SB.0 2.01%

6. BehavesLike.Win32.Malware (v) 1.04%

7. Worm.Win32.Downad.Gen (v) 0.96%

8. Trojan.Win32.Malware.a 0.93%

9. Trojan.Win32.Meredrop 0.92%

10. Exploit.PDF-JS.Gen (v) 0.84%

-----
Community News You Can Use
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
Follow us on Twitter:  @GAFrontPage

Protect Your Computer: Don’t be Scared by 'Scareware'

We’ve all seen them—pop-up messages telling you your computer is infected with a virus. To get rid of it, all you have to do is order the antivirus software being advertised.

Before you click, though, know this: few Internet security companies use ads to tell you about a virus on your computer. Most of these pop-ups are scams, and it’s one of the fastest-growing types of Internet fraud today.

These scams have a name. They’re called “scareware” because they try to frighten you into purchasing fake antivirus software with a seemingly genuine security warning. But if you do try to buy this program, it will either do nothing…or it could compromise your computer by installing malicious software onto your system. And in some instances, you don’t even have to click on the pop-up box…the software downloads automatically.

Cyber criminals often use notorious botnets—networks of compromised computers under their control—to push out their software. They’ll also masquerade as legitimate Internet security companies and buy ads on other websites—called “malvertising”—but when consumers click on the ads to purchase the products, they are redirected to websites controlled by the bad guys.

Many of these criminals operate outside the U.S., making investigations difficult and complex for the FBI and its partners. But we’ve had successes—just this past May, for example, three people were charged in Illinois in connection with a scheme that caused Internet users in more than 60 countries, including the U.S., to buy more than $100 million worth of bogus scareware software.

Two of the defendants, including an American, are accused of running an overseas company that claimed to sell antivirus and computer performance/repair software over the Internet. A third man operated the company’s Cincinnati call center, which was responsible for technical and billing support to its customers (but in reality deflected complaints from consumers who realized the software didn’t work).

According to the indictment, proceeds from the sales of the software (which was typically purchased by credit card) were deposited into bank accounts controlled by the defendants and others throughout the world and then quickly transferred to accounts in Europe.

In addition to the consumers victimized by the scam, a number of legitimate companies tricked into selling ad space on their websites for the bogus software were allegedly defrauded of about $85,000 in unpaid fees.

Don’t let it happen to you. Here are a few words of advice on scareware.

How to spot a scareware scam:

* Does the pop-up use “non-clickable” icons? To build authenticity into their software, scareware will show a list of reputable icons—like those of software companies or security publications. However, the user can’t click through to the sites to see the actual reviews or recommendations.
* Is the pop-up ad hard to close? Scareware pop-ups employ aggressive techniques and will not close easily after clicking the “close” or “X” button.
* Have you heard of the software before? Cyber criminals use easy-to-remember names like Virus Shield, Antivirus, or VirusRemover.

How to protect yourself from scareware: Make sure your computer is fully protected by legitimate, up-to-date antivirus software.

If you think you’ve been victimized by scareware: File a complaint with the FBI’s Internet Crime Complaint Center.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
Follow us on Twitter:  @GAFrontPage

Pop-up Advertisements Offering Anti-virus Software Pose Threat to Internet Users

An ongoing threat exists for computer users who, while browsing the Internet, began receiving pop-up security warnings that state their computers are infected with numerous viruses.

These pop-ups known as scareware, fake, or rogue anti-virus software look authentic and may even display what appears to be real-time anti-virus scanning of the user's hard drive. The scareware will show a list of reputable software icons; however, the user cannot click a link to go
to the actual site to review or see recommendations.

The scareware is intimidating to most users and extremely aggressive in its attempt to lure the user into purchasing the rogue software that will allegedly remove the viruses from their computer. It is possible that these threats are received as a result of clicking on advertisements contained on a website. Cyber criminals use botnets to push the software and use advertisements on websites to deliver it. This is known as malicious advertising or malvertising.

Once the pop-up appears it cannot be easily closed by clicking "close" or the "X" button. If the user clicks on the pop-up to purchase the software, a form is provided that collects payment information and the user is charged for the bogus product. In some instances, whether the user clicks on the pop-up or not, the scareware can install malicious code onto the computer. By running your computer with an account that has rights to install software, this issue is more likely to occur.

Downloading the software could result in viruses, Trojans and/or keyloggers being installed on the user's computer. The repercussions of downloading the malicious software could prove further financial loss to the victim due to computer repair, as well as, cost to the user and/or financial institutions due to identity theft.

The assertive tactics of the scareware has caused significant losses to users. The FBI is aware of an estimated loss to victims in excess of $150 million.

Be cautious — cyber criminals use easy to remember names and associate them with known applications. Beware of pop-ups that are offering a variation of recognized security software. It is recommended that the user research the exact name of the software being offered.

Take precautions to ensure operating systems are updated and security software is current.

If a user receives these anti-virus pop-ups, it is recommended to close the browser or shut the system down. It is suggested that the user run a full, anti-virus scan whenever the computer is turned back on.

If you have experienced the anti-virus pop-ups or a similar scam, please notify the IC3 by filing a complaint at www.IC3.gov.

----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page