Panda Security’s 2007 virus year in review

At the start of the new year, Panda Security publishes – as it does every year – a list of the twelve most unusual computer pests of the past twelve months.

Archive notice: This article was originally published on January 4, 2008. Links and embedded videos are preserved as part of the historical record.

The “dirty dozen” does not necessarily consist of the most harmful viruses, worms, Trojans, etc., but of intruders that stand out from the grey mass of digital pests, whether because they missed their purpose, because they express the programmers’ creativity or because they were able to trick computer users with nasty tricks.

Here are the nastiest, most amusing and most conspicuous pests of 2007:

The PR Trojan: Computer users received the latest news about the iPhone from the Aifone.A Trojan. As soon as the smartphone developed by Apple was on the market, Aifone.A advertised it – even though its actual aim was to spread its harmful code.

The kidnapper: The Sinowal.FY Trojan encrypts all documents on infected systems and prevents the data packages from being opened. In this way, it forces affected users to buy a special tool to decrypt the coded data hostages. The ransom for the kidnapped documents is 300,- dollars. If payment is not made, the pest threatens the irrevocable deletion of all data. To accelerate the payment process and put the user under pressure, it sets a deadline.

The entertainer: While the RogueMario.A worm installs itself on computers, it entertains affected users by providing them with a version of the popular computer game Mario Bros to distract them from its harmful activities.

The politician: With its appeal to take part in the elections in Kenya, the Voter.A worm shows social interest. However, it influences potential voters by presenting them with its preferred candidate – over and over again, because the corresponding image is displayed on the screen every nine seconds. Whether this type of support brings the candidate the necessary popularity is very doubtful.

The spy: The AttachMsngr.G Trojan is distinguished by an immense hunger for knowledge and a large dose of curiosity. Everything the computer user does appears to be of interest to the pest: It records every keystroke, every movement of the mouse and every communication the user makes via MSN Messenger. Unfortunately, however, the knowledge acquired in this way can become a major threat to the user.

The Halloween worm: Right on time for Halloween, the Nuwar worm made a human skeleton dance on the screens of infected computers to the song “Boom Boom Bomm” by the Venga Boys. Unfortunately, the worm installed itself on the computers at the same time and turned them into zombies.

The storyteller: While the CivilArmy.B worm infects a computer, it opens the text file “SexStory” on the screen, in which it tells of a hot summer romance with an older woman. Instead of the happy ending, however, the user is met with the following message: “ha ha ha ha – you are victim – end of story”.

The lucky charm: “Happy New Year!” – this is the subject line of the message in which the Nuwar.B worm hides. As a New Year’s gift, the owner of the infected computer receives a stock tip that is supposedly going to bring major profits because the value of the recommended share is expected to rise dramatically.

The lovestruck one: The Valentine’s worm Nurech.A spread at lightning speed in February. It particularly targeted male users: Almost exclusively female first names were used as senders. Love letters such as “Together You and I”, “Everyone needs Someone” or “Cyber Love”, however, turned out to be nothing more than malware gateways.

The cyber pirate: “Pirates of the Caribbean 3” – the cinema event of the spring lured not only numerous film fans into cinemas but also careless computer users into the malware trap. The Pirabbean.A Trojan stole sensitive data from infected computers by promising exclusive scenes and images from the film in a trailer. It spread via emails containing a skull and crossbones and with the subject “Pirates of the Caribbean: At world’s end”.

The romantic: The UzaScreener.A worm makes itself noticed in a very nerve-racking way: It shuts infected computers down and starts them up again ten times in succession, then replaces the screen background with a black image on which the words “U.Z.A. Operating System” can be Read. The worm’s program code contains the following message: “U.Z.A. O/S is a virus made by ANJ which is dedicated to his very sweet and lovely wife, AAZ…With lots of love.”

The curious one: Every time the LiveDeath.A Trojan infects computers, it forces the affected users to answer a long catalogue of questions to save their data. Unfortunately, there is no correct answers to questions such as “What is your favourite colour?” – the computer crashes in every case.