Malware Declines, Trojans Dominate
Orome1 writes "According to data gathered by Panda Security, only 39 percent of computers scanned in February were infected with malware, compared to 50 percent last month. Trojans were found to be the most prolific malware threat, responsible for 61 percent of all cases, followed by traditional viruses and worms which caused 11.59 percent and 9 percent of cases worldwide, respectively. These figures have hardly changed with respect to the January data."
So that's how many hundred million bots?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I blame the UN/Satanic New World Order/Illuminati population control conspiracy...
I wonder what caused it? Adobe did patch a few of their nastier PDF & Flash bugs. It'd be funny if that's all there was. Suck for computer shops though, business is way down :P.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I've cleaned others' PCs for forever and a day, and I've always wondered about this.
malware = malicious software
trojan = malicious software pretending to be good software
However, most of my experience with so called malware is things like fake virus scanners and browser bars and weather gadgets, etc. To me that seems pretty tojan-esque.
Does it have to contain a hijacking element in order to be considered a trojan? That would make sense for the analogy, but I've never heard it described that way.
Should have used a Trojan sized tissue!
Waiting for the other shoe to...
If it only resides in one directory, consider yourself lucky. The last one I was dealing with (can't recall the name, but it was one of the ones that screws with your Internet connection and redirects everything to their "pay $75 and you get to use your computer again" site) put copies of itself in a half dozen places, several of them quite creative,all with different and innocuous-sounding filenames. Each one was programmed to start up, look for the existence of the others, and if one or more were missing it copied itself to them and re-established the startup for each of the missing ones.
One of them was even programmed to only check-and-restore on every five startups or so, so the whole damned thing came back while I was in the middle of catching the computer up on its Windows Updates, an hour after I thought I had the machine completely scrubbed clean. It was hiding itself under a filename that looked like a driver for the touchpad. Clever bit of thinking, actually - victim takes computer to pro, pro cleans the gunk out, victim takes machine back home and a week or so later the infection magically reappears.
Took me hours to rip out that sunovabitch. I told the user to back up their data NOW and if it came back to bring the machine back with the recovery discs so I could nuke the damned thing from orbit.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
"According to data gathered by Panda Security, only 39 percent of computers scanned in February were infected with malware, compared to 50 percent last month
And exactly how did 11% of them get cleaned up over the last month???
Just another day in Paradise
Panda Security software must be installed on all the computers that it scanned. So if 50% of those computers had infections last month and 39% of them STILL have infections now, then I conclude that Panda Security software is surprising ineffective against malware and trojans.
If wonder if this has anything to do with Microsoft's recent inclusion of MSE in Windows Update. It's been a little while now since this happened, maybe it's starting to make a difference.
http://it.slashdot.org/story/10/11/05/205256/MS-Adds-Security-Suite-To-Update-Service-Antivirus-Rival-Objects
I had the chance of looking at someone's pc the other day, only to find that they are now shipping with webservers and redirect your HOSTS files to your own computer as alias for banks. So your "bank" connection is speedy and never fails, once they gather the data, I guess they'll report it somewhere else. To remove this, I had to go around looking for where the webserver was, among other temporary, hunting files was the most annoying part of it
I have been having great luck with Vipre Rescue. They distribute this rescue program as an updated executable so you just download the most current version and run it on the infected machine. If you can get to windows, it works very well. I can even unzip it and launch it remotely on computers using psexec.
Cheap storage VM.
I have had exactly the same experience this week, I had 3 infected machines on Monday, and a further 12 on Tuesday, and yes, most had fully updated AV on them. In a normal week I would clear about 4 or 5 machines of various types of malware and trojans, but something has been running riot this week! The desktop image on all the infected machines looks like old school malware that I used to see around 6 or 7 years ago!
Hi flowerpotgirl! If it is that damned security tool variant I feel your pain. I have gotten to the point if they say that have "some sort of security thingie bugging me" I tell them to back up anything they want to keep to flash or DVD (which I'll be happy to sell them or they can use their own) and then I just nuke the bastard. After nuking I scan the flash/DVD with a LiveCD and put their stuff back on. That security tool variant is a royal bitch, and with each new version they add more checks and more places to hide!
In the old days it was easy to clean the bugs out but these new security tool and AV20xx variants are just too damned nasty. You can spend all day cleaning one out only to have a timebomb restore the bug! Nuke it from orbit, it is the only way to be sure anymore.
ACs don't waste your time replying, your posts are never seen by me.