Press Releases

• All releases feed |

Bournemouth, UK (6th August 2008) – Despite the dominance of malware targeting online gamers and the persistence of INF/Autorun, the continuing presence of Virtumonde and Toolbar.MyWebSearch in ESET’s monthly report of top ten threat detections suggests that adware is still a big profit generator for malware operators. However, even though programs like this have dubious credentials, anti-malware companies are reluctant to flag “potentially unwanted applications” as out-and-out malware and detection is often an option, rather than a scanner default.

This is because some adware and spyware can be considered legitimate, especially if it mentions the behaviour that makes it potentially unwanted in the EULA, demonstrating that it pays to read the small print. Both Virtumonde and Toolbar.MyWebSearch are classified by ESET as potentially unwanted applications. They create a profit for malware operators by delivering adverts direct to the user’s desktop or directing web searches through MyWebSearch.com. But is it appropriate that “legitimate” applications should deliberately try and hide themselves from anti-malware scanners, which is one aspect that Virtumonde’s distributors pay particular attention to.

“Virtumonde has become a particularly difficult problem for vendors and users alike, far more than our classification as adware or potentially unwanted application might suggest,” comments David Harley, Director of Malware Intelligence, ESET. “It is consistently represented in our top ten scores, despite the fact that its distributors keep changing Virtumonde’s characteristics and delivery mechanism to hide it from us, which suggests that we’re pretty successful at detecting it. But if it does manage to install itself, it can be very difficult to automate removal completely, often requiring manual intervention.”

Once installed, some variants of Virtumonde are very difficult to disinfect safely with the malware in memory. Some vendors have published a “generic” removal process, but ESET does not believe that this is always appropriate, because it assumes a fairly static infection and removal procedure, whereas the Virtumonde gang goes to some lengths to make the process both variable and difficult. ESET says that this is when it becomes essential to have an interactive support process.

“Not surprisingly, the bad guys concentrate a lot of R&D effort on hiding from the most commercially successful anti-virus products and all of the major anti-malware scanners have difficulty detecting or removing at least some specimens of Virtumonde, unless their settings are so paranoid as to be almost unusable. We’ve just made some alterations to our detection method that should put us ahead for a while, but fighting Virtumonde has become a war of attrition, not a boxing match. The arena changes, the advantage swings from the bad guys to the good guys, but there is no final knockout,” concludes Harley.

Top 10 Threats for July 2008:

1 Win32/PSW.OnlineGames – 12.72%
2 INF/Autorun – 4.68%
3 Win32/Adware.Virtumonde – 4.41%
4 Win32/Pacex.Gen – 2.88%
5 Win32/Toolbar.MyWebSearch – 2.31%
6 JS/TrojanDownloader.Wimad.N – 1.90%
7 JS/Exploit.RealPlay.LF – 1.56%
8 Win32/TrojanDownloader.Murlo.NN – 1.35%
9 Win32/Qhost – 1.31%
10 WIN32/AutoRun.KS – 1.19%

###

About ThreatSense.Net
ThreatSense.Net includes data about all types of threats seen attacking user systems. This (anonymised) statistical information is collected from those users of ESET security software who choose to enable the reporting service in the product and gives a comprehensive view of the behaviour and spread of malware in the real world. Data is currently collected from more than 10 million systems.

About ESET
ESET develops software solutions that deliver comprehensive protection against evolving computer security threats. ESET pioneered and continues to lead the industry in proactive threat detection. ESET NOD32 Antivirus, its flagship product, consistently achieves the highest accolades in all types of comparative testing and is the foundational product that extends the ESET product line to include ESET Smart Security. Both products have an extremely efficient code base that avoids the unnecessary large footprint found in some solutions. This means faster scanning that doesn’t slow down computers or networks.
Sold in more than 110 countries, ESET has worldwide production headquarters in Bratislava, SK and worldwide distribution headquarters in San Diego, U.S. ESET also has offices in UK, Argentina and Czech Republic and is globally represented by an extensive partner network. For more information, visit www.eset.co.uk or call 0845 838 0832.

Media Contact:
Sara Claridge
Marylebone Media Relations
sara@marylebone.co.uk
+44 (0) 20 8133 5572
+44 (0) 7968 626838 (mobile)
www.marylebone.co.uk


Contact Name: Sara Claridge
Role: Director
Company: Marylebone Media Relations
Contact Email: click to reveal e-mail
Contact Phone: 02081335572
Company Website: http://www.marylebone.co.uk

Tags (click tag to find related articles; click icon for feed):
malware | eset | virus | adware |

Categories:
it/internet/software

This press release has been viewed 320 times.