Top 10 U.S. Botnet Threats
By Luciana on July 28, 2009 | Malware, botnet, Zeus trojan, Koobface, TidServ, Trojan.Fakeavalert, TR/Dldr.Agent.JKH, Monkif, Hamweq, Swizzor, Gammima, Gamania, Gamina, Krap, Frethog, Vaklik, Conficker, botnets, statistics
Damballa, an online security company based in Atlanta, Georgia, has recently published a list of 10 most active botnets in the United States. The list contains the names of the most widely spread online security threats as well as the number of computers infected by each of them. Spywared.com strongly suggests to pay serious attention to this list as it provides the information about the most dangerous programs that have already infected millions of computers causing serious system damage and personal data theft.
#1: Zeus
3.6 million computers infected in the U.S.
The Zeus Trojan is made to steal personal data from the infected system: account and credit card numbers, usernames and passwords. It compromises the online banking log-in pages by injecting fake HTML forms and stealing the user data.
#2: Koobface
2.9 million computers infected in the U.S.
Koobface is distributed mainly through the social networks , such as Facebook, Twitter and MySpace with the help of false messages from the user's friends. Such messages usually include links to some videos that the user is advised to watch. However, when the link is followed it asks to install additional codecs which are necessary to view the video. If installed, these applications may cause some serious system dysfunctions.
#3: TidServ
1.5 million computers infected in the U.S.
It usually gets into the system as an attachment to a spam email message. TidServ is able to configure itself to run as a legitimate Windows service or even launch while Windows runs in the Safe Mode. It is also known to help spread some fake system security tools. It hides most of its files and registry entries making its removal process highly complicated.
#4: Trojan.Fakeavalert
1.4 million computers infected in the U.S.
Trojan.Fakeavalert is now mostly used for downloading malicious programs, false system security warnings and bogus anti-spyware, although formerly it was more of a spamming tool.
#5: TR/Dldr.Agent.JKH
1.2 million computers infected in the U.S..
This botnet is known to nest in the infected system and to constantly receive commands from its mother domain. The main goal of TR/Dldr.Agent.JKH is to upload various ads into the infected computers screen, therefore is also known as a clickbot.
#6: Monkif
520,000 computers infected in the U.S.
What Monkif does is download and install malicious applications called Browser Helper Objects into the infected system.
#7: Hamweq
480,000 computers infected in the U.S.
Hamweq a.k.a IRCBrute, autorun worm, is a backdoor worm that is able to multiply itself once it gets into the computer. It is also able to get into the removable drives and execute automatically when such a drive is accessed. It injects itself into Explorer.exe and generates registry entries that enable Hamweq to load at startup. It also steals information and various data from the compromised computer.
#8: Swizzor
370,000 computers infected in the U.S.
This malicious application may download and install rogue security programs, trojans and files from the web into the user's system without any notice.
#9: Gammima
230,000 computers infected in the U.S.
Gammima is probably best known for getting into the International Space Station in the summer of 2008. This application may also hide under the names of Gamania, Gamina, Krap, Frethog and Vaklik. The main objects of Gammima's interest are the online game accounts, logins and passwords. It also loads into the address space of the Window's processes, such as Explorer.exe and spreads via removable computer devices, for example the USB keys.
#10: Conficker
210,000 computers infected in the U.S.
Conficker is a downloader worm, also known as Downadup, reported to have spread more in the rest of the world that in the United Stats. It is mostly used to download and to promote various malicious programs. Although it has been actively used as a tool for selling false anti-spyware applications, it is not that dangerous anymore and spreads throughout the web without causing any real damage. However, the general sense that it might still acquire some actually harmful purpose has not disappeared.
More Malware news
Introducing threats : Trojans
Computer world is packed with various forms of malicious software. Even a soccer-mom knows what a virus is and what can it do to a computer. However, sometimes we tend to underrate some types of malicious programs because to most of us nothing evidently horrible has yet happened. But by doing so we are very mistaken. Trojans are sometimes mistaken with computer worms or viruses. They are neither. Read more.- Children's gaming website is used to spread malware
- Malware steals your money
- Mobile phones are always at risk of attacks
- Spam email about Kim Jong-il's death leads to malware
- Delete fake "Attention! Your PC is Infected" security alert
- Malicious SMS manager - a threat for Androids
- Anonymous is creating Guy Fawkes virus
- Mac OS X hit by mysterious Tsunami
- Gaddafi’s death is explored by scammers
- A new way for spreading malware - online game item trade
