A leading security vendor GFI Software warns that the number of malicious PDF files detected in the wild has significantly increased last month with two detections making it into the top ten.
According to data gathered by the company’s ThreatNet system, two PDF exploits detected as Exploit.AbobeReader.Gen and Exploit.PDF-JS.Gen, finished the month on the eight and ninth places as far as malware detections go.
As was the case in December 2010, seven of the top 10 malware detections were Trojans, with those seven accounting for almost 34% of all malware detections for the month.ThreatNet also revealed an increase in the FakeVimes rogues that were reported last month, when FraudTool.Win32.FakeVimes!delf (v) hit the number nine spot with .73 percent of all detections. This represents a VIPRE heuristics detection for malicious code associated with the FakeVimes family of rogue security products, illustrating the continued growth of fake and compromised security applications as a means to circulate and covertly install malware onto PCs.
In January, a detection of PersonalInternetSecurity2011.FakeVimes (.64 percent of detections) was at the number 12 spot and the top 50 also included Antivirus8.FakeXPA, FraudTool.Win32.FakeVimes!VB (v) and Win32.FakeVimes!delf (v). There are approximately 17 rogues that are considered members of the FakeVimes family. They first appeared in January of last year.
Twitter users fell victim to a fake antivirus software scam in January as a number of accounts began distributing links promoting rogue security software. The attack used Google’s Web address shortening service to conceal the links’ destination. Twitter worked to reset passwords, but there is no telling how many users were led to malicious sites due to this phishing attack. GFI Software provided detailed instructions of how to remove the Security Shield fake antivirus program in one of its support forums.
ThreatNet is GFI Lab’s monitoring system that retrieves real-time data from VIPRE installations. Statistics come from tens of thousands of machines running VIPRE.
Top 10 detections for December
Detection Type Percent
Trojan.Win32.Generic!BT Trojan 21.38
Trojan.Win32.Generic.pak!cobra Trojan 3.71
Trojan-Spy.Win32.Zbot.gen Trojan 3.69
INF.Autorun (v) Trojan 1.68
Trojan.Win32.Generic!SB.0 Trojan 1.59
Worm.Win32.Downad.Gen (v) Worm.W32 1.47
FraudTool.Win32.FakeAV.hdd (v) Trojan 1.06
Exploit.AbobeReader.Gen (v) PDF Exploit 1.06
Exploit.PDF-JS.Gen (v) PDF Exploit 0.80
Trojan.ASF.Wimad Trojan 0.73
Top 10 most prevalent malware infections between December 2010 and January 2011
