Drive-by exploit codes dominate top ten
Drive-by-download components dominate February’s list of top ten e-threats, according to BitDefender.
These drive-by-download components are atomic bits of malware strung together like a "daisy-chain" by malware creators. Each "atom" represents another attempt by cyber-criminals to compromise the security of a user’s system.
In first position for the second time this year – but with a much smaller lead than last month – is Norton-bypassing ad-serving malware, Trojan.Clicker.CM. Clicker.CM displays a large number of commercial pop-up windows in the current Web browser’s background attempting to lure the user to click.
If clicked, profits are generated for advertisements registered within a pay-per-click system. The trojan also uses several functions that bypass the Norton Internet Security Pop-up Blocker.
Ranked 2nd, we find an older "daisy chain" – Trojan.Wimad.Gen.1 or the Wimad trojan, which masquerades as a player component for malicious ASF files. This trojan is loaded via a downloader trojan ranked last in the top ten e-threats list.
The Conficker virus and its brethren are also present in this month’s top ten via a generic detection against viruses that use the recent autorun bug in Windows – Trojan.AutorunINF.Gen with 4,17% of detections.
Ranked 8th is Trojan.IFrame.GA, a simple script which gets injected in compromised Webpages and sends browsers to a collection of exploits such as Trojan.Exploit.ANPI (ranked 7th), which can direct vulnerable systems to a page containing Trojan.Exploit.SSX (in 5th position).
"This particular infection chain was taken directly from the analysis of a number of compromised and/or malicious Web sites hosted in China," explains Sorin Dudea, head of BitDefender Antimalware Research. "However, these exploits and downloaders may appear in similar attacks as well."
Three more downloaders, not previously found in the top ten lists, appear this month (Trojan.Downloader.JS.Psyme.SR, Trojan.Downloader.JLPK and Trojan.Downloader.Js.Agent.F), all serving the simple function of downloading and launching more malware onto affected computers from Web sites.
Loading ...