Virus situation review for March 2007 from DrWeb Company

The virus monitoring service of DrWeb Company has carried out the analysis of virus situation in March 2007. On the whole, March was quiet enough, but it was not without surprise. But this quiet is rather â€œlull before the stormâ€, as long as the practice shows the major epidemics arise spontaneously. The opposition of e-mail worms of Win32.Dref (also known as Storm Worm) and Win32.HLLM.Limar (also known as Email-Worm.Win32.Warezov and Win32/Stration), the peak of which was recorded in February 2007, in March was slack enough. The authors of Win32.HLLM.Limar fired two waves of their â€œcreationâ€. Nevertheless they were quickly localized and hadnâ€™t brought about the epidemic. The authors of Win32.Dref stick to their methodology of the frequent updating of software modules using polymorphic wrappers. In the mid month they recorded the peak of spread of net and e-mail worms of Chinese origin â€“ the representatives of not unknown families of Win32.HLLW.Whboy, Win32.HLLW.Gavir, Win32.HLLW.Hang, and also new Win32.HLLW.Bush, Win32.HLLM.Cobas. Besides, during the whole month they noted the appearance of new modifications of e-mail worm of Win32.HLLM.Graz family. The referred surprise is not so much the appearance as the generality of infections by script-virus, named by Dr. Web classification as VBS.Igidak. The virus monitoring service of Dr. Web Company and the technical assistance agency received repeated signals from users on the infected computers by VBS.Igidak. The curious point is the fact that the main source of infection was flash-drive. At the time when the primary source of the epidemics is e-mail and net worms, various trojan software, which are distributed in the Internet, such generality looks rather ambiguous. Nevertheless, this epidemic had short-term character, this statistics data show: Besides, the spread of malicious software is recommenced, which has been named according to Dr. Web classification as Trojan.Plastix. For the first time this programme was fixed at the end of 2005. This program was extended as a universal code generator for account replenishment of mobile operators. Those who risked to take the advantage of such "useful" program, great disappointment was waited, their computer has been practically unworkable, because there were many changes in the system registry, the work with the registry is blocked, windows closing also, all the tags on the desktop are deleted, etc. When launching Windows the user sees a message that his computer is struck, and for its treatment he needs to transfer into some determined mailbox the mentioned amount of sum. Such cyberblackmail though meets infrequently but each time resulting in a local epidemic, the last â€œwaveâ€ was noted in January 2006, when modification of Trojan.Encoder.6 was actively distributed. You should bear in mind that in such occasions you should not transfer money to the plotters. This again confirms the fact that you must carefully treat the downloaded programs and expose them to preliminary scanning for viruses before running them. If your computer has been struck by Trojan.Plastix, you can always turn to the technical assistance agency of Dr. Web Company. There theyâ€™ll help you to restore the functionality of the computer.