Sunbelt Software Announces Top Ten Spyware Threats for August; Stats from Leading Security Provider Show Trojan Smitfraud for the First Time in Top Ten for Most Reported Prevalent Threats

Business Wire, Sept 5, 2006

CLEARWATER, Fla. -- Sunbelt Software, a leading provider of Windows security software, today announced the top ten most prevalent spyware threats for the month of August. The results are based on the monthly scans performed by Sunbelt's award-winning antispyware product CounterSpy(TM). The Trojan.Smitfraud threat appears for the first time in the top ten lists and is a trojan that is used to download rogue security products and change the user's desktop to display false warnings that the computer is infected with spyware.

The top ten most prevalent spyware threats for the month of August are:

1. DesktopScam                          2.22%

    2. Trojan-Downloader.Zlob.Media-Codec   1.46%

    3. Virtumonde                           0.96%

    4. Command Service                      0.83%

    5. Trojan.Smitfraud                     0.80%

    6. Trojan.WinlogonHook.Delf.A           0.72%

    7. DollarRevenue                        0.70%

    8. Zango.SearchAssistant                0.68%

    9. StartPage.TimesSquare                0.63%

    10. SpySheriff                          0.62%

DesktopScam

This program is used to trick the affected user into purchasing certain security applications. DesktopScam will display false warnings that the computer is infected and uses a fake Windows update globe to trick the user into thinking that Microsoft Windows is reporting a spyware infection. Clicking on this notification directs the user to a pre-defined website to order malware removal software. In some cases the SecurityToolbar.DesktopScam may be present as well.

Zlob.Media-Codec

Zlob.Media-Codec is a trojan that installs rogue security software on the infected machine without notice and consent. It purports to be a needed codec or upgrade to Windows Media Player when users attempt to watch certain adult/porn videos to trick the user into downloading it. Once downloaded, it contacts remote servers and initiates the download of rogue security software such as SpywareQuake.

Virtumonde

Virtumonde is an adware program that displays pop-up advertisements on the desktop and also downloads other software from various remote servers. There are many variants of Virtumonde, some with trojan-like behaviors including downloading other software without notice and consent, transmitting information to remote servers without notice and consent, and lowering system security on the infected machine.

Command Service

Command Service is an adware application that opens pop-ups and displays various types of advertising on the user's desktop while browsing web pages. Command Service is installed by a number of drive-by downloaders, including IE-Plugin.

Trojan.Smitfraud

Trojan.Smitfraud downloads and installs programs that purport to scan for adware and spyware and typically display false reports of spyware in order to frighten the user into paying for the program.

Trojan.WinlogonHook.Delf.A

WinlogonHook.Delf.A is a backdoor trojan that gives an attacker the ability to control the infected machine without the user's knowledge. It attaches itself to the Winlogon process and runs every time Windows is booted up and may contact remote servers to download and install additional malware.

DollarRevenue

DollarRevenue is an adware program that spawns pop-up advertising on the desktop and downloads other adware. It is typically installed without consent or notice through a security exploit and is accompanied by additional adware. DollarRevenue files can contact the internet and initiate the download of so much adware that the computer may become unusable. It is known to have been installed from the same site as a password stealing trojan.

Zango.SearchAssistant

Zango.SearchAssistant opens new browser windows showing websites based on the previous websites you visit. The adware will run in the background on a computer and will periodically direct users to other sponsors' websites, allowing users to compare prices between websites. While the Software is installed on the computer, Zango may collect information about users and the websites visited. This information will be used to provide users with comparative shopping opportunities when they are most relevant. By installing and/or using the Software users grant permission for Zango to periodically display sponsors' websites.

StartPage.TimesSquare

StartPage.TimesSquare hijacks the IE start page and search pages and displays ads. Antivirus software identifies this as a Trojan.StartPage variant.

SpySheriff

SpySheriff is a purported anti-spyware application to scan for and remove spyware from users' computers. SpySheriff is known to be distributed through exploits that also download adware or spyware on users' computers without notice or consent. When SpySheriff is downloaded through an exploit, it puts a red icon in the system tray and shows a false warning that the computer is infected with spyware.

About Sunbelt Software's Threat Research Center

The Sunbelt Software Threat Research Center specializes in the discovery and analysis of dangerous vulnerabilities (i.e., security holes, bugs, maligned features or combination of operations) that could be exploited for Internet and email attacks. The research team actively researches new spyware outbreaks, creating and testing new spyware definitions on a constant basis. For detailed spyware research information and to view the top ten spyware in real-time please visit http://research.sunbelt-software.com.