New Trojan Variants Bypass Leading Antivirus Solutions

A massive number of e-mail-borne computer viruses evaded leading antivirus software in the second half of Q2 2009, according to Commtouch (an Internet security company) which has recently released its Internet Threats Trend Report (Q2 2009).

A number of successive and enormous malware attacks resulted in increase of malware that leading AV engines could not detect.

As per the report, malware distributors and spammers employed ongoing events such as the demise of Michael Jackson and the Swine influenza to successfully distribute their malicious e-mails. Additionally, websites in 'Web-based' and 'Health' e-mails ranked top on the catalog of Website groupings manipulated by phishers.

The most infected website grouping was 'business' sites, with a mean of 376,000 new compromised PCs getting activated daily to run the malicious activity. Moreover, image-based spam reappeared by using new techniques replacing MIME-format models for beating anti-spam solutions.

The report also states that spam levels remained at an average rate of 80% of the total e-mail traffic during Q2 2009, reaching a peak of 97% during April and plummeting to 64% during June 2009. Brazil is the country with the maximum number of bot-infected zombies spewing 17.5% of the total worldwide zombie activity.

Amir Lev, CTO of Commtouch, said - between January 2008 and June 2009, antivirus software successfully stopped numerous viruses with standard signatures, as reported by Help Net Security on July 14, 2009.

Lev added that during Q2 2009, malware purveyors unleashed huge numbers of fresh Trojan variants that were immune to the standard signatures, resulting in steep rises in unidentified malicious programs that Commtouch blocked.

Meanwhile, the company explained that the huge appearance of the Trojan variants was because of the gestation periods between the detection of malware by antivirus firms and their development of defensive signatures.

The firms have attempted at stopping fresh Trojan versions using a continuously running signature for each version, but this proved ineffective, therefore they have started creating separate standard signatures for blocking whole families of individual Trojan samples. However, since the recent variants emerged in such large quantities, these standard signatures too have proven unworkable.

Related article: New Zealand Releases Code To Reduce Spam

» SPAMfighter News - 8/3/2009