GFI Software’s ThreatNet™ statistics also show continued prominence of rogue security products and Trojan horse programs
GFI Software, a leading IT solutions provider for small and medium-sized enterprises, today revealed continuing high levels of rogue security products circulating during January, and a surge in malware that takes aim at vulnerabilities within Adobe Reader and the .pdf file format – two of the top 10 detections are aimed at exploiting holes within Adobe. The top 10 data is compiled from monthly scans performed by GFI's award-winning anti-malware solution, VIPRE® Antivirus, and its antispyware tool, CounterSpy®, as a service of GFI Labs™.
As was the case in December 2010, seven of the top 10 malware detections were Trojans, with those seven accounting for almost 34% of all malware detections for the month.ThreatNet also revealed an increase in the FakeVimes rogues that were reported last month, when FraudTool.Win32.FakeVimes!delf (v) hit the number nine spot with .73 percent of all detections. This represents a VIPRE heuristics detection for malicious code associated with the FakeVimes family of rogue security products, illustrating the continued growth of fake and compromised security applications as a means to circulate and covertly install malware onto PCs.
In January, a detection of PersonalInternetSecurity2011.FakeVimes (.64 percent of detections) was at the number 12 spot and the top 50 also included Antivirus8.FakeXPA, FraudTool.Win32.FakeVimes!VB (v) and Win32.FakeVimes!delf (v). There are approximately 17 rogues that are considered members of the FakeVimes family. They first appeared in January of last year.
Twitter users fell victim to a fake antivirus software scam in January as a number of accounts began distributing links promoting rogue security software. The attack used Google's Web address shortening service to conceal the links' destination. Twitter worked to reset passwords, but there is no telling how many users were led to malicious sites due to this phishing attack. GFI Software provided detailed instructions of how to remove the Security Shield fake antivirus program in one of its support forums.
“Another indicator of increased rogue activity is the fact that we discovered, and blogged about, 22 new rogues on the GFI Rogue Blog in January (http://rogueantispyware.blogspot.com/). That’s a lot for one month, considering we’ve seen an average of between 13 and 14 new iterations per month for the last three years,” said Tom Kelchner, communications and research analyst for GFI Software.
ThreatNet is GFI Lab’s monitoring system that retrieves real-time data from VIPRE installations. Statistics come from tens of thousands of machines running VIPRE.
Top 10 detections for December
| Detection | Type | Percent |
| Trojan.Win32.Generic!BT | Trojan | 21.38 |
| Trojan.Win32.Generic.pak!cobra | Trojan | 3.71 |
| Trojan-Spy.Win32.Zbot.gen | Trojan | 3.69 |
| INF.Autorun (v) | Trojan | 1.68 |
| Trojan.Win32.Generic!SB.0 | Trojan | 1.59 |
| Worm.Win32.Downad.Gen (v) | Worm.W32 | 1.47 |
| FraudTool.Win32.FakeAV.hdd (v) | Trojan | 1.06 |
| Exploit.AbobeReader.Gen (v) | PDF Exploit | 1.06 |
| Exploit.PDF-JS.Gen (v) | PDF Exploit | 0.80 |
| Trojan.ASF.Wimad | Trojan | 0.73 |
To see a graphical comparison of the top 10 most prevalent malware infections between December 2010 and January 2011, please visit: https://images.gfi.com/GFIThreatNetJan2011Chart.jpg
About GFI Labs
GFI Labs specializes in the discovery and analysis of dangerous vulnerabilities (i.e., security holes, bugs, maligned features or combination of operations) that could be exploited for Internet and email attacks. The research team actively researches new malware outbreaks, creating and testing new threat definitions on a constant basis.
About GFI
GFI Software provides web and mail security, archiving, backup and fax, networking and security software and hosted IT solutions for small and medium-size businesses (SMBs) via an extensive global partner community. GFI products are available either as on-premise solutions, in the cloud or as a hybrid of both delivery models. With award-winning technology, a competitive pricing strategy, and a strong focus on the unique requirements of SMBs, GFI satisfies the IT needs of organizations on a global scale. The company has offices in the United States (North Carolina, California and Florida), UK (London and Dundee), Austria, Australia, Malta, Hong Kong, Philippines and Romania, which together support hundreds of thousands of installations worldwide. GFI is a channel-focused company with thousands of partners throughout the world and is also a Microsoft Gold Certified Partner.
