Top 10 U.S. Botnet Threats
By Luciana on July 28, 2009 | Malware, botnet, Zeus trojan, Koobface, TidServ, Trojan.Fakeavalert, TR/Dldr.Agent.JKH, Monkif, Hamweq, Swizzor, Gammima, Gamania, Gamina, Krap, Frethog, Vaklik, Conficker, botnets, statistics
Damballa, an online security company based in Atlanta, Georgia, has recently published a list of 10 most active botnets in the United States. The list contains the names of the most widely spread online security threats as well as the number of computers infected by each of them. Spywared.com strongly suggests to pay serious attention to this list as it provides the information about the most dangerous programs that have already infected millions of computers causing serious system damage and personal data theft.
#1: Zeus
3.6 million computers infected in the U.S.
The Zeus Trojan is made to steal personal data from the infected system: account and credit card numbers, usernames and passwords. It compromises the online banking log-in pages by injecting fake HTML forms and stealing the user data.
#2: Koobface
2.9 million computers infected in the U.S.
Koobface is distributed mainly through the social networks , such as Facebook, Twitter and MySpace with the help of false messages from the user's friends. Such messages usually include links to some videos that the user is advised to watch. However, when the link is followed it asks to install additional codecs which are necessary to view the video. If installed, these applications may cause some serious system dysfunctions.
#3: TidServ
1.5 million computers infected in the U.S.
It usually gets into the system as an attachment to a spam email message. TidServ is able to configure itself to run as a legitimate Windows service or even launch while Windows runs in the Safe Mode. It is also known to help spread some fake system security tools. It hides most of its files and registry entries making its removal process highly complicated.
#4: Trojan.Fakeavalert
1.4 million computers infected in the U.S.
Trojan.Fakeavalert is now mostly used for downloading malicious programs, false system security warnings and bogus anti-spyware, although formerly it was more of a spamming tool.
#5: TR/Dldr.Agent.JKH
1.2 million computers infected in the U.S..
This botnet is known to nest in the infected system and to constantly receive commands from its mother domain. The main goal of TR/Dldr.Agent.JKH is to upload various ads into the infected computers screen, therefore is also known as a clickbot.
#6: Monkif
520,000 computers infected in the U.S.
What Monkif does is download and install malicious applications called Browser Helper Objects into the infected system.
#7: Hamweq
480,000 computers infected in the U.S.
Hamweq a.k.a IRCBrute, autorun worm, is a backdoor worm that is able to multiply itself once it gets into the computer. It is also able to get into the removable drives and execute automatically when such a drive is accessed. It injects itself into Explorer.exe and generates registry entries that enable Hamweq to load at startup. It also steals information and various data from the compromised computer.
#8: Swizzor
370,000 computers infected in the U.S.
This malicious application may download and install rogue security programs, trojans and files from the web into the user's system without any notice.
#9: Gammima
230,000 computers infected in the U.S.
Gammima is probably best known for getting into the International Space Station in the summer of 2008. This application may also hide under the names of Gamania, Gamina, Krap, Frethog and Vaklik. The main objects of Gammima's interest are the online game accounts, logins and passwords. It also loads into the address space of the Window's processes, such as Explorer.exe and spreads via removable computer devices, for example the USB keys.
#10: Conficker
210,000 computers infected in the U.S.
Conficker is a downloader worm, also known as Downadup, reported to have spread more in the rest of the world that in the United Stats. It is mostly used to download and to promote various malicious programs. Although it has been actively used as a tool for selling false anti-spyware applications, it is not that dangerous anymore and spreads throughout the web without causing any real damage. However, the general sense that it might still acquire some actually harmful purpose has not disappeared.
More Malware news
25% of worms use USB drives to spread
According to Panda’s report, 25% of worm based malware spreads through the USB drives. Even more, most of viruses are designed to spread via USB drives. Security Company confirms that cybercriminals are very persistent and put a lot of efforts to make user’s life impossible. 25% of latest created malware are configured to enter the system through portable storage devices, usually USB drives. Read more.- Save your Androids: first trojan spotted in the wild
- Dell Shares Information about Malware Infecting their Server’s Motherboards
- 123greetings.com is a new ZeuS Crimeware Campaigners Target
- Remove Fake Adobe Flash Player Install
- Fake Microsoft Security Essentials Launched
- Remove Flooder.Skypflood, Flooder.Skypflood Removal
- Remove FunnyMall, FunnyMall Removal
- Fake Virus Total
- Remove BankerFox.A Trojan, BankerFox.A Trojan Removal
- New malware arrives in form of numerous clones
