Malware Declines, Trojans Dominate

Orome1 writes "According to data gathered by Panda Security, only 39 percent of computers scanned in February were infected with malware, compared to 50 percent last month. Trojans were found to be the most prolific malware threat, responsible for 61 percent of all cases, followed by traditional viruses and worms which caused 11.59 percent and 9 percent of cases worldwide, respectively. These figures have hardly changed with respect to the January data."

Comments

"Only" 39 percent.

[John Hasler]

So that's how many hundred million bots?

Re:"Only" 39 percent.

[natehoy]

The problem with statistics like this from someone who offers a free antivirus scanner is that, well, people will download it as their first antivirus software, generally once they discover that antivirus might be a good idea. So that 39% is not fully representative of all computers out there, only ones where people have suddenly discovered a need for antivirus and want something free.

I don't know about you, but people only come to me for help once their computers start "slowing down" or "acting funny", and the first thing I do is install a free antivirus client for them and do a scan. And, surprise surprise, I'd say 90% of the Windows computers I've worked on have had some form of malware intrusion, in many cases pages full of them. I think I've had one co-worker have me look at a computer when she first bought it, and that was after her last computer had a really bad infection, so she wanted to make sure the new one stayed clean.

It's like the ER saying that 80% of the population they observe have severe injuries, or (oblig. car analogy) a tire shop claiming that 70% of the cars entering their shop have worn tires. Of course they do! You don't go to the ER unless you need to see a doctor RFN, and you generally don't go to a tire shop if you aren't seriously contemplating new tires. In the same vein, many (most?) people don't start taking antivirus seriously until their trial version of McNorton ran out a year ago and their computer is acting a little funny ever since that cute fluffy bunny video didn't work from that guy with the funny name in East Nowherestan.

So, honestly, I'm very surprised the number is that low.

Re:"Only" 39 percent.

[Dragonslicer]

Which operating system allows this?

Any operating system that lets you install your own software is vulnerable to Trojans. Most Linux distributions would be less vulnerable if you can get the user to understand how to only ever install software from the official repositories, but a stupid user is going to follow the instructions on some random website to get new screen savers no matter what operating system they're using.

Re:"Only" 39 percent.

[causality]

I know my personal record is fixing someone's computer only to find it had over 16,000 difference pieces of malware on it

... that you knew about.

Re:"Only" 39 percent.

[hairyfeet]

Well I can't answer for him, but I can say my personal record at the last shop I worked at was 4673 pieces of malware all running on this top o' the line Toshiba laptop. It actually took one hour and 43 minutes to boot! Normally we'd just do a wipe and reinstall and never mess with it, but the boss had bet me a pizza and a six pack that it wouldn't beat his record of 2879 pieces of malware running. But I had taken one look at the hipster douche that had brought it in and said "I think I'm beating your record today Doug!". Sure enough I was enjoying a meat lovers and a cold one for supper.

So while I find it hard to believe that someone could get 16,000 bugs and still function you'd be surprised how much shit a user can add before Windows will completely die. The hipster douche had every porn bug known to man and had so many running processes that the brand new Toshiba ran like a 486 trying to load Win98. But we didn't count cookies, only malware, so yeah you get some seriously nasty machines walking in sometimes.

Re:"Only" 39 percent.

[hairyfeet]

The problem is MSFT can only add so much before screams of "anti trust!" fill the web. Just look at the stink Norton and the rest tried to put up when Windows started coming with Defender and MSFT started offering Security Essentials for free. Now we all now that if Windows came packed with a free fully functional AV like MS Security it would seriously cut down the rates of infections, but that would not only cut into the pay AV business but would hurt the OEMs by not getting paid to bundle crapware time limited AV.

So in a way you can look at this as just another failing of capitalism, as the long term better for everyone solution is rejected in deference to the short term lets make a buck solution. I know that using a few simple third party tools I am able to make Windows "a toaster with a screen" which is one of my most popular optimizations, where it cleans and defrags its file system and registry, fixes broken shortcuts, takes care of its own AV updates and scanning, hell if I could come up with a way to auto-install third party updates it would be damned near perfect, as it is I have to simply have the OS alert the user when the latest flash or other update is ready.

But sadly if MSFT was to do that, even though it would make the net safer and faster and better for everyone, all the vendors of solutions to those problems would scream "Anti Trust!" so fast it would make your head swim. So in the end we get what we have now, where the user has to know more than they should because many want to profit off their misery. Sad but that is the way of things.

Re:"Only" 39 percent.

[camperslo]

Well I guess ya disproved the myth that Windows users can't make use of multiple cores...

Increasing numbers of Trojans?

[fuzzyfuzzyfungus]

I blame the UN/Satanic New World Order/Illuminati population control conspiracy...

Re:Serious question

[Haedrian]

A trojan opens backdoors in the system, so the controller can either hijack your computer or send more malware your end. If it doesn't do that, its not a trojan.

So a virus which pops up "VIRUSES DETECTED! BUY THIS PRODUCT" is malware but not a trojan.

Think about the Trojan horse in the greek myth, when it got in, it opened the gates for worse things to come.

Re:System Tools

[natehoy]

If it only resides in one directory, consider yourself lucky. The last one I was dealing with (can't recall the name, but it was one of the ones that screws with your Internet connection and redirects everything to their "pay $75 and you get to use your computer again" site) put copies of itself in a half dozen places, several of them quite creative,all with different and innocuous-sounding filenames. Each one was programmed to start up, look for the existence of the others, and if one or more were missing it copied itself to them and re-established the startup for each of the missing ones.

One of them was even programmed to only check-and-restore on every five startups or so, so the whole damned thing came back while I was in the middle of catching the computer up on its Windows Updates, an hour after I thought I had the machine completely scrubbed clean. It was hiding itself under a filename that looked like a driver for the touchpad. Clever bit of thinking, actually - victim takes computer to pro, pro cleans the gunk out, victim takes machine back home and a week or so later the infection magically reappears.

Took me hours to rip out that sunovabitch. I told the user to back up their data NOW and if it came back to bring the machine back with the recovery discs so I could nuke the damned thing from orbit.

Re:System Tools

[hairyfeet]

Hi flowerpotgirl! If it is that damned security tool variant I feel your pain. I have gotten to the point if they say that have "some sort of security thingie bugging me" I tell them to back up anything they want to keep to flash or DVD (which I'll be happy to sell them or they can use their own) and then I just nuke the bastard. After nuking I scan the flash/DVD with a LiveCD and put their stuff back on. That security tool variant is a royal bitch, and with each new version they add more checks and more places to hide!

In the old days it was easy to clean the bugs out but these new security tool and AV20xx variants are just too damned nasty. You can spend all day cleaning one out only to have a timebomb restore the bug! Nuke it from orbit, it is the only way to be sure anymore.