Panda IDs 2007 'odd nine' malware

By Leon Engelbrecht, ITWeb senior writer

Johannesburg, 14 Jan 2008

Last year saw no end to malicious software, but some malware examples were simply curious, says Panda Security.

PandaLabs spokesman Alex Matthews says "no matter how interesting they seem, it is best to steer well clear of these threats by using good, up-to-date security software with proactive technologies".

He says the top curiosities identified in the second half of 2007 included a Trojan that promoted the iPhone, a knock-down version of Google and an automatic test translator.

In detail, 2007's 'odd nine' malware were:

* Modern times: "The Aifone.A Trojan was no doubt the most up-to-the-minute example of malicious code detected in recent months. As soon as Apple's iPhone was launched, this malware was promoting it... albeit as a trick to help spread copies of itself among users," Matthews says.

* Kidnapped: "Sinowal.FY is a Trojan designed to encrypt files it finds on infected computers, forcing users to buy a specific tool in order to decrypt them. A real kidnapper with users' files in the role of hostages," he notes.

* A most mischievous worm: "RogueMario.A is a worm that aims to entertain users as it infects them. This malicious code is designed to install a version of the famous Mario Bros game every time it infects a computer. How kind!"

* Lost in translation: "Worms such as MSNFunny.B, Mimbot.A or MsnSend.A might be welcome in any international communication agency, as they can send out messages in dozens of languages," says Matthews. "The phrases might not have been very well constructed, but you can't have everything!"

* On the campaign trail: "Voter.A is a worm with a civic conscience, inviting citizens of Kenya to participate in elections and vote for one of the candidates. Unfortunately, the technique is a little annoying, as it displays an image of the candidate every nine seconds. It is doubtful whether this type of 'support' will be doing the candidate any favours."

* A poor imitation: The Sohanat.DB prevents users from accessing certain search engines, displaying instead an imitation, albeit a poor one, of the Google page. If users visit any of the pages that are listed by this search engine, they will most likely be taken to a pornographic Web site or infected with malware. "Had the creators paid a bit more attention to detail, they might have had more success," Matthews says.

* I spy: "AttachMsngr.G is a Trojan with a real thirst for knowledge; knowledge, that is, about everything that users do on their computers: it captures keystrokes, mouse movements and can even store MSN Messenger conversations," adds Matthews. "If a little knowledge is a dangerous thing, in this case at least, a lot of knowledge is worse."

* Telling tales: "CivilArmy.B is a worm that knows how to tell a story. Before warning users that their computer is infected, it tells a romantic tale about two young lovers. Perhaps it is an attempt to encourage users to read more... or perhaps not."

* The big question: "The LiveDeath.A Trojan, whenever it infects a computer, opens the command console and forces users to respond to a number of questions, such as 'What is your favourite colour?' However, regardless of the answer, the computer will shut down."