The April virus activity review from Doctor Web features a description of latest samples of ransomware and the latest modification of BackDoor.Maosboot using new rootkit technologies.

The main trend of April 2009 was the wide spread of numerous species of ransomware targeting various user groups. Modifications of Trojan.Blackmailer displaying an adult content banner on every loaded web-page and variations of Trojan.Winlock that blocked access to Windows became the most typical pieces of extortive malware.

Till recent time Trojan.Blackmailer could only be installed in a system as a plugin for Internet Explorer. However, the last month saw its compatibility expanded. The new modification of the Trojan found by Doctor Web virus analysts could also perform its malicious tasks as a plugin for Opera and Mozilla Firefox. It entered the Dr.Web virus classification as Trojan.BrowseBan.

Considering immense number of variations of Trojan.Winlock Doctor Web created a special web-form that enabled users to unlock their systems free of charge. The form is constantly updated as new modifications of the program are discovered.

Rootkits

In April Doctor Web updated its GUI Scanner that featured the updated anti-rootkit module Dr.Web Shield to ensure that it was capable of neutralizing a new modification of BackDoor.Maosboot. The latest variation of the rootkit retained all malicious features of its predecessors but also had an enhanced self-protection mechanism. The Dr.Web scanner searches for BackDoor.Maosboot in RAM and bootsectors and cures a system compromised by the rootkit.

Spam

No severe fishing attacks were registered in April except for few instances of phishing mailings targeting customers of Chase Bank and eBay.

In spite of the decrease in number of malicious programs spreading via e-mail April was marked by a mass mailing of Trojan.PWS.Panda.114 sent to users in an attached zip archive. To lure a user into launching the archived executable file, the archive content was described as an invoice issued by the WorldPay following a supposed payment on an order of goods or services.

May 2009 can see development of new rootkit technologies and other techniques that would make neutralization of malware more complicated for anti-virus vendors. New phishing schemes are expected to be implemented by cyber criminals. Doctor Web recommens all users to be more careful while surfing the web or opening messages from strangers. If you consider a message or a file to be suspicious, don’t hesitate to consult the support service of your anti-virus vendor.

Malicious files detected in mail traffic in April

Malicious files detected on user machines in April