Koobface, the infamous worm, was first detected by Kaspersky Lab as Net-Worm.Win32.Koobface, and it instantly became popular when it appeared almost one year ago targeting Facebook and MySpace accounts. The Koobface worm is spreading through a legitimate user’s account to their friends’ profiles. Comments and messages sent by the worm contain a link to a fake YouTube-style Web site which invites users to download a “new version of Flash Player”. The worm, rather than a media player, is then downloaded to victim machines. Once a user is infected, he or she will start spreading such messages to his or her friends. In the meantime, the functionality of the worm has been extended. Koobface is now targeting more social networking Web sites like Facebook, MySpace, Hi5, Bebo, Tagged, Netlog and, most recently, Twitter.

As social networks such as Facebook or Twitter are becoming increasingly popular, attacks targeting them are also gaining momentum.

“This sign of increased cybercriminal activity involving social networks in the past month proves that the strategies being used by the bad guys to infect users are much more efficient when adding the social context to their attacks,” says Stefan Tanase, Malware researcher of Kaspersky Lab. “June 2009 marks an important milestone in the evolution of social networking malware — the activity we’ve seen this month exceeds by far any other month in the past.

Kaspersky Lab would like to give a few tips for Users:

• Be cautious when opening links coming through suspicious messages, even if the sender is one of your trusted Facebook friends.
• Use either Internet Explorer 7 running in protected mode or Firefox with NoScript installed.
• Divulge as little personal information as possible. Do not give out your home address, phone number or other private details.
• Keep your antivirus software updated to prevent new versions of malware from attacking your computer.

Kaspersky Lab users running any of the Company’s current anti-malware products are fully protected from all known variants of Net-Worm.Win32.Koobface. Kaspersky Lab’s global team of analysts are keeping a close eye on all threats coming from the social networking space, monitoring the malicious activity and constantly updating the protection customers receive.

Around five to six million computers are currently believed to be infected by Kido (aka Conficker, Downadup), one of the most notorious malicious software programs to hit the Internet recently, according to security company Kaspersky Lab.

In a videoconference dubbed, “Presenting the truth about malware speculation,” Kaspersky Lab said the huge botnet formed by computers infected by Kido potentially provides cybercriminals with the means to conduct devastating DDoS (distributed denial-of-service) attacks on any Internet resource, to steal confidential data from  both  home users and corporate networks and to distribute unsolicited content (e.g. mass spam mailings).

Vitaly Kamluk, director of Kaspersky Lab’s Global Research and Analysis Team (GReAT), said there are 126,594 PCs in the Philippines infected by the Conficker virus as of March 2009. Kaspersky Lab’s data showed the Philippines ranked 19th globally among countries with the most Conficker infections topped by China with 2,649,674, Brazil with 1,017,825 and Russia 835,970. In the South East Asian region, the Philippines trailed fourth following Malaysia 212,477, Thailand 165,080 and Indonesia 164,794.

Citing figures from research firm Consumer Economics, Kaspersky Lab says the annual global financial damages from malware attacks on businesses exceeded US$ 13 billion in 2007.

The videoconference was participated by six countries across South-East Asia, namely, the Philippines, Malaysia, Singapore, Indonesia, Thailand and Vietnam.

“There is no definite amount on how much damage the Conficker virus has made on businesses so far because it continues to spread at a phenomenal rate and cybercriminals have become more sophisticated in creating difficult to detect malwares such as Conficker to steal important data from our devices, ” said Suk Ling Gun, managing director of Kaspersky Lab South-East Asia.

“As a preventive measure against future malware attacks such as Conficker, Kaspersky Lab advises PC owners and IT managers of companies to treat this issue seriously and not remain complacent — Internet users need to constantly educate themselves and update their security software,” said Gun.

The new variant of Sinowal, a malicious program that is capable of hiding its presence in the system by infecting the Master Boot Record (MBR) on the hard drive, was detected by the company’s experts at the end of March 2009.

Throughout 2008, Kaspersky Lab’s analysts provided detailed reports about other variants of this rootkit: in the first quarterly report on malware evolution and in the article “Bootkit: the challenge of 2008”. However, the new variant has come as a surprise for researchers. Unlike earlier versions, the new modification, Backdoor.Win32.Sinowal, penetrates much deeper into the system to avoid being detected. The stealth method used in this variant hooks device objects at the operating system’s lowest level. This is the first time cybercriminals have used such sophisticated technologies. This explains why no antivirus products could treat computers infected with the new Sinowal modification or even detect it when it first appeared. Once the bootkit penetrates the system, it conceals the payload’s activities, which are designed to steal user data and various account details.

According to Kaspersky Lab’s experts, over the last month the bootkit has been actively spreading from a number of malicious sites that exploit Neosploit vulnerabilities. In particular, it can penetrate a system via a vulnerability in Adobe Acrobat Reader that allows a malicious PDF file to be downloaded without the user’s knowledge.

Implementing detection and treatment for the bootkit, which is still spreading throughout the Internet, is the most difficult task that antivirus specialists have faced for a number of years. Kaspersky Lab was one of the first major antivirus vendors to incorporate both detection and successful treatment for the new Sinowal modification in its personal antivirus solutions.

To check whether the bootkit has infected a computer, users must update their antivirus databases and perform a complete system scan. If the bootkit is detected, the computer will need to be rebooted during the treatment process.

Kaspersky Lab specialists also recommend users to install all the necessary patches to close vulnerabilities in Acrobat Reader and any browsers that they use.

About Kaspersky Lab

Kaspersky Lab delivers the world’s most immediate protection against IT security threats, including viruses, spyware, crimeware, hackers, phishing, and spam. Kaspersky Lab products provide superior detection rates and the industry’s fastest outbreak response time for home users, SMBs, large enterprises and the mobile computing environment. Kaspersky technology is also used worldwide inside the products and services of the industry’s leading IT security solution providers. For further information, please visit www.kaspersky.com. For the latest on anti-virus, anti-spyware, anti-spam and other IT security issues and trends, please visit www.viruslist.com.

The first Top Twenty is based on data collected by Kaspersky Lab’s version 2009 antivirus product. The ranking is made up of the malicious programs, adware and potentially unwanted programs most frequently detected on users’ computers.

Position / Name
1 Net-Worm.Win32.Kido.ih
2 Virus.Win32.Sality.aa
3 Trojan-Dropper.Win32.Flystud.ko
4 Trojan.Win32.Chifrax.a
5 Trojan.Win32.Autoit.ci
6 Trojan-Downloader.Win32.VB.eql
7 Packed.Win32.Krap.b
8 Worm.Win32.AutoRun.dui
9 Exploit.HTML.CodeBaseExec
10 Packed.Win32.Black.a
11 Virus.Win32.Sality.z
12 Virus.Win32.Virut.ce
13 Trojan.JS.Agent.xy
14 Worm.Win32.Mabezat.b
15 Virus.Win32.Alman.b
16 Packed.Win32.Krap.g
17 Packed.Win32.Klone.bj
18 Worm.Win32.AutoIt.ar
19 Exploit.JS.Agent.agc
20 Email-Worm.Win32.Brontok.q

Making an impression this month were two newcomers, Virus.Win32.Virut.ce and Exploit.HTML.CodeBaseExec.
Virut.ce entered near the top of our second ranking in February and now looks set to dominate the first ranking as well. New versions of the virus are appearing every day, which suggests that cybercriminals are monitoring how and when the malware is detected by antivirus programs and trying to increase the size of the botnet made up of infected machines. The epidemic caused by this virus is gaining momentum and May could well see Virut.ce moving several places up the rankings.

The second newcomer is a little piece of malware history – the first version of this program was detected by Kaspersky Lab way back in 2004. It featured regularly in our malware rankings in 2006, but is now flagged as a newcomer because the format and methods used to compile our Top Twenty rankings have changed. The malware exploits a simple vulnerability in versions 5.01, 5.5 and 6.0 of Internet Explorer. It seems that the cybercriminals are hoping that there will still be a significant number of people who have not installed the relevant security updates or who still use older versions of Internet Explorer.

Trojan.Win32.Chifrax.a dropped out of our ranking last October but has now returned and gone straight in at number four. This Trojan, like RaMag.a, is a modified WinRAR archive, which in this instance is a self-extracting archive.

The April ranking includes two script downloaders – Trojan.JS.Agent.xy and Exploit.JS.Agent.agc – that are perfect examples of the type of programs used in drive-by downloads, a topic they recently published a paper on (http://www.viruslist.com/en/viruses/analysis?pubid=204792056).

All malicious, advertising and potentially unwanted programs in the first Top Twenty can be grouped according to the main classes of threat detected. In the past few months, the changes in the balance between these classes have not exceeded 5%.
TrojWare – 25%
VirWare – 45%
MalWare – 30%
A total of 45190 unique malicious, advertising, and potentially unwanted programs were detected on users’ computers in April. This figure is almost exactly the same as last month’s.

The second Top Twenty presents data on which malicious programs most commonly infected objects detected on users’ computers. Malicious programs capable of infecting files make up the majority of this ranking.

Position / Name
1 Virus.Win32.Sality.aa
2 Worm.Win32.Mabezat.b
3 Virus.Win32.Virut.ce
4 Net-Worm.Win32.Nimda
5 Virus.Win32.Xorer.du
6 Virus.Win32.Sality.z
7 Virus.Win32.Parite.b
8 Virus.Win32.Virut.q
9 Virus.Win32.Alman.b
10 Virus.Win32.Small.l
11 Email-Worm.Win32.Runouce.b
12 Net-Worm.Win32.Kido.ih
13 Trojan-Downloader.HTML.Agent.ml
14 Virus.Win32.Virut.n
15 Virus.Win32.Parite.a
16 Virus.Win32.Hidrag.a
17 Worm.Win32.Fujack.k
18 P2P-Worm.Win32.Bacteraloh.h
19 Trojan-Clicker.HTML.IFrame.acy
20 Virus.Win32.Virut.av

There was little change to the second Top Twenty ranking in April. The only real activity of note was the appearance of another Virut modification in the ranking – Virus.Win32.Virut.av. This virus was first detected by Kaspersky Lab in 2007 and is still active.

It means the Virut family claims four places in this Top Twenty, which amounts to 20% of the self-replicating programs in our second ranking.

About Kaspersky Lab
Kaspersky Lab delivers the world’s most immediate protection against IT security threats, including viruses, spyware, crimeware, hackers, phishing, and spam. Kaspersky Lab products provide superior detection rates and the industry’s fastest outbreak response time for home users, SMBs, large enterprises and the mobile computing environment. Kaspersky technology is also used worldwide inside the products and services of the industry’s leading IT security solution providers. For further information, please visit www.kaspersky.com. For the latest on anti-virus, anti-spyware, anti-spam and other IT security issues and trends, please visit www.viruslist.com.