New Trojan variants evade major anti-virus engines

Millions of e-mail viruses bypassed major anti-virus engines during the second half of the second quarter, according to the Q2 2009 Internet Threats Trend Report by Commtouch.

Several successive and massive malware outbreaks caused a spike in malware that was undetected by major AV engines, compared to the consistently low quantities of malware that had been distributed via email during the previous 18 months.

Other highlights from the report include:

• Spammers and malware distributers used current events including the Swine Flu epidemic and death of Michael Jackson to spread their messages.
• Sites in the “Health” and “Web-based email” categories topped the list of Web categories manipulated by phishing schemes.
• “Business” was the Web site category most infected with malware.
• An average of 376,000 zombies were newly activated each day for the purpose of malicious activity.
• Image-based spam returned with new tactics foregoing MIME-format standards to trick anti-spam engines.
• Spam levels averaged 80% of all email traffic throughout the quarter, peaking at 97% in April and bottoming out at 64% in June.
• Brazil continues to produce the most zombies, responsible for 17.5% of global zombie activity.

“For the last year and a half, anti-virus engines effectively blocked many virus variants with generic signatures,” said Amir Lev, CTO of Commtouch. “In the second quarter, however, malware distributors introduced large quantities of new variants which are immune to these generic signatures, therefore causing sharp increases in undetected malware samples that were blocked by Commtouch.”