VB - 2006 03 Virus Bulletin - March 2006

Virus Bulletin - March 2006

Editor: Helen Martin

Technical Consultant: Matt Ham

Technical Editor: Morton Swimmer

Consulting Editor: Ian Whalley, Nick FitzGerald, Richard Ford, Edward Wilding

2006-03-01

Abstract

View from the cheap seats (comment); Proxies for the underworld: I-Worm.Locksky.AS (virus analysis); IM_a nuisance - W32.Imav.A (virus analysis); How can a web filter add proactive security? (feature); Improving proactive detection of packed malware (feature); Changes to the VB test sets (comparative update); Solving the metamorphic puzzle (technical feature)


Comment

View from the cheap seats

'Our jobs and our day-to-day successes and failures are still as much about people and what they do (and don't do) as they ever were.' Max Morris, independent author, USA.

Max Morris - Independent author, USA


News

Hotbar adware dispute settled

Symantec settles adware case.



Updating niggles

Troublesome month for security vendors.



Malware prevalence report

January 2006

The Virus Bulletin prevalence table is compiled monthly from virus reports received by Virus Bulletin; both directly, and from other companies who pass on their statistics.



Virus analyses

Proxies for the underworld: I-Worm.Locksky.AS

The Locksky email worm first appeared in October 2005. Its aim is to install proxies on victims' machines, which can then be sold. Ferenc Laszlo Nagy has the details.

Ferenc Laszlo Nagy - VirusBuster, Hungary


IM_a nuisance – W32.Imav.A

Two years after its emergence the Beagle family is still one of the most pervasive families of Internet worms. John Canavan takes a close look at one variant that has made the surprising switch from email to ICQ as its major infection vector.

John Canavan - Symantec Security Response, Ireland


Features

How can a web filter add proactive security?

Steen Pedersen explains how the perimeter defence layer can be enhanced with the use of a web filter.

Steen Pedersen - Equant, Denmark


Improving proactive detection of packed malware

Dynamic translation is a technique that can be used instead of emulation for decrypting complex malware. Adrian Stepan describes how the technique can also be used to perform generic unpacking.

Adrian Stepan - Microsoft, USA


Comparative update

Changes to the VB test sets

VB's product reviewer Matt Ham describes some changes to the test sets used for VB's comparative reviews.

Matt Ham - Virus Bulletin, UK


Technical feature

Solving the metamorphic puzzle

Metamorphic viruses have posed a challenge for the anti-virus industry for quite some time. This article focuses on a number of metamorphic techniques and highlights different methods for detecting them.

Rodelio G. Fiñones - Fortinet Technologies, Canada & Richard Fernandez - Trend Micro, Philippines


Spam Bulletin

Spam Bulletin - March 2006

This month's anti-spam news and Andrej Bratko describes the use of data compression models to fight spam.




Poll

Should anti-virus software be free for personal use?
Yes
No
I don't know

Leave a comment
View 21 comments

Jobs Career Sidebar

Malware Prevalence

Agent |####################|
Zbot |##############|
Suspect packers |############|
Dropper-misc |###########|
Delf |#####|
 View this month's full report
Virus Bulletin currently has 143,027 registered users.