Home→Support→About viruses

Choose your language

About viruses: Main sources of threats penetration

At the present time the main types of threats for the information on your computer are internet and e-mail. Great number of Malware includes viruses, Trojans, worms, that can penetrate your computer while you read an email message or an article on the Internet, search the information, open web-sites, download, and install software on your computer.

Malware spreads flash-like and harms your computer within a second so that it is very costly to restore your computer. The matter is not only in damaging the data, but in unauthorized access to the system, breaking its integrity, information leakage.

Spam – another important source of “troubles” – should not be forgotten about. Unrequired mail correspondence (spam) cam harm more than some Malware. Not being a source of direct threat, spam leads to waste of working time and can cause unjustified financial losses, these losses increase hundred and thousand times when it refers to a corporative computer network.

Each user who widely deploys modern informational resources should know what threats him/her and what consequences this or that malicious impact may cause. The most malicious sources of threats penetration are:

Internet – global information net is the main source of spreading any type of Malware. As a rule viruses and other malicious programs are located on popular web-sites in Internet, “disguising” as useful and free software. Abound of scripts that run automatically when opening a web-site may also contain Malware.
Email – mails received by the user stored in the mail bases, may contain viruses as well. Malware can be either in attachment or in the body of a message. As a rule mails contain viruses and mail worms. You can infect the data on your PC either when opening the massage or when saving on a disc a file attached to the message. Mail can also be the source of two other threats: spam and phishing. If spam causes mainly waste of time, then the aim of phishing is your confidential information (e.g. number of your credit card).
Vulnerabilities in software – so called “holes” in software are the main source of hacker attacks. Vulnerabilities grant hacker remote access to your PC, and correspondingly to your personal data, to the LAN/Ethernet resources available to you, and other sources of information.
Removable data carriers – removable drives and memory expansion cards (flash-cards) are still widely used to transfer information. By running a file saved on a removable carrier, you can harm the data on your computer with a virus and then involuntarily spread this virus onto other drives of your computer.

If you suspect that your computer is infected with viruses, we recommend you, then install a trial version of Kaspersky Internet Security, update databases and run full computer scan. You can also download and install a free utility Kaspersky Virus Removal Tool 2011.

About viruses: Types of known threats

To know what can threat your data you should know what malicious programs (Malware) exist and how they function. Malware can be subdivided in the following types:

Viruses: programs that infect other programs by adding to them a virus code to get access at an infected file start-up. This simple definition discovers the main action of a virus – infection. The spreading speed of viruses is lower than that of worms.

Worms: this type of Malware uses network resources for spreading. This class was called worms because of its peculiar feature to “creep” from computer to computer using network, mail and other informational channels. Thanks to it spreading speed of worms is very high.

Worms intrude your computer, calculate network addresses of other computers and send to these addresses its copies. Besides network addresses, the data of the mail clients' address books is used as well. Representatives of this Malware type sometimes create working files on system discs, but may not deploy computer resources (except the operating memory).

Trojans: programs that execute on infected computers unauthorized by user actions; i.e. depending on the conditions delete information on discs, make the system freeze, steal personal information, etc. this Malware type is not a virus in traditional understanding (i.e. does not infect other programs or data): Trojans cannot intrude the PC by themselves and are spread by violators as “useful” and necessary software. And still harm caused by Trojans is higher than of traditional virus attack.

Spyware: software that allows to collect data about a specific user or organization, who are not aware of it. You may not even guess about having spyware on your computer. As a rule the aim of spyware is to:

Trace user's actions on computer
Collect information about hard drive contents; it often means scanning some folders and system registry to make a list of software installed on the computer.
Collect information about quality of connection, way of connecting, modem speed, etc.

Collecting information is not the main function of these programs, they also threat security. Minimum two known programs – Gator and eZula – allow violator not only collect information but also control the computer. Another example of spyware are programs embedded in the browser installed on the computer and retransfer traffic. You have definitely come across such programs, when inquiring one address of a web-site, another web-site was opened. One of the spyware is phishing- delivery.

Phishing is a mail delivery whose aim is to get from the user confidential financial information as a rule. Phishing is a form of a social engineering, characterized by attempts to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an apparently official electronic communication, such as an email or an instant message. The messages contain link to a deliberately false site where user is suggested to enter number of his/her credit card and other confidential information.

Adware: program code embedded to the software without user being aware of it to show advertising. As a rule adware is embedded in the software that is distributed free. Advertisement is in the working interface. Adware often gathers and transfer to its distributor personal information of the user.

Riskware: this software is not a virus, but contains in itself potential threat. By some conditions presence of such riskware on your PC puts your data at risk. To this software refer utilities of remote administration, programs that use Dial Up-connection and some others to connect with pay-per-minute internet sites.

Jokes: software that does not harm your computer but displays messages that this harm has already been caused, or is going to be caused on some conditions. This software often warns user about not existing danger, e.g. display messages about hard disc formatting (though no formatting is really happening), detect viruses in not infected files and etc.

Rootkit: these are utilities used to conceal malicious activity. They disguise Malware, to prevent from being detected by the antivirus applications. Rootkits can also modify operating system on the computer and substitute its main functions to disguise its presence and actions that violator makes on the infected computer.

Other malware: different programs that have been developed to create other Malware, organizing DoS-attacks on remote servers, intruding other computers, etc. Hack Tools, virus constructors and other refer to such programs.

Spam: anonymous, mass undesirable mail correspondence. Spam is political and propaganda delivery, mails that ask to help somebody. Another category of spam are messages suggesting you to cash a great sum of money or inviting you to financial pyramids, and mails that steal passwords and credit card number, messages suggesting to send them to your friends (messages of happiness), etc. spam increases load on mail servers and increases the risk lose information that is important for the user.

If you suspect that your computer is infected with viruses, we recommend you:

Install a trial version of a Kaspersky Lab product, update databases ans run full computer scan.
Use free utility Kaspersky Virus Removal Tool 2011.

About viruses: Viruses and solutions

How to protect my computer from Trojan-Ransom (Winlock) using Application Control in Kaspersky Lab product

Back to "Viruses and solutions" section

ID: 7193

Complexity

2013 Mar 26

Trojan-Ransom malware aims to block access for the user to a computer or restrict work on the computer. It demands monetary payment to unblock the computer and to return it to the initial state.

The main peculiarity of Trojan-Ransom family is its commercial orientation. Each program of this class is an instrument to trick the money out of users and to deliver it to cybercriminals.

If your computer is infected with a program of the Trojan-Ransom family, then use the Deblocker service.

To avoid possible infection with Trojan-Ransom family, use the preventive recommendations, described below.

1. For Kaspersky Internet Security 2013

In order to secure computer protection, a user can use the Application Control component from Kaspersky Internet Security 2013.
The component registers all actions performed by applications run in the system and controls them according to special rules. These rules control applications' access to system resources.
In order to secure your computer protection, it is required to create a rule that will control applications' access to some registry keys. It is recommended to create rules for the following registry keys:

*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*
*\SOFTWARE\Policies\*
*\SOFTWARE\Policies\*\
*\SOFTWARE\Policies\*\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*\*

To create a rule, do the following:

Step 1. Create a category

Open Kaspersky Internet Security 2013.
In the upper right part of the window click Settings.

In the Settings window on the Protection Center tab select Application Control.
In the right part of the window click the Identity protection button.

In the Digital Identity Protection window select the resource Identity data and in the upper panel click Add category.

In the Identity data category window enter AntiWinLock into the field and click OK.

Step 2. Add resources to AntiWinLock category

In the Digital Identity Protection window select the category AntiWinLock at the bottom of the list of resources. Then, do the following:

Registry keys without names

In the upper panel in the Digital Identity Protection window click the Add button and in the drop-down menu select Registry key.

In the User resource window click the Browse button to enter the path that should be controlled by Application Control.

At the bottom of the Select registry object window enter a registry key and its value:
- In the Key field enter: *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- In the Value field enter: Shell
Click the OK button.

In the User resource window click the OK button.

Perform the actions described in Registry keys without names for the following resources:

Key: *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value: AppInit_DLLs
Key: *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: Userinit
Key: *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*
Value: *

Registry keys with names

In the upper panel in the Digital Identity Protection window click the Add button and in the drop-down menu select Registry key.

In the User resource window enter Winlock.Policies.Values and click the Browse button.

At the bottom of the Select registry object window enter the registry key and its value:
- In the Key field enter: *\SOFTWARE\Policies
- In the Value field enter: *
Click the OK button.

In the User resource window click the OK button.

Perform the actions from the section Registry keys with names for the following resources:

Name: Winlock.Policies.Keys
Key: *\SOFTWARE\Policies\*
Value: *
Name: Winlock.Policies.Values.Sub
Key: *\SOFTWARE\Policies\*
Value: *
Name: SafeBoot.Values
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
Value: *
Name: SafeBoot.Keys
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*
Value: *
Name: SafeBoot.Values.Sub
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*
Value: *

As a result of the actions all ten resources added to the AntiWinLock category will be displayed in the Digital Identity Protection window.
Click the OK button.

Step 3. Change a rule for the group

In the right part of the Settings window click the Applications button.

In the Applications window select the Low Restricted folder and at the top of the window click the Edit button.

In the Group rule window go to the Files and system registry tab.
In the Group rules window for the AntiWinLock group rules set the Block action for the columns Read, Write, Delete, and Create the following way:
- Select an operation, right-click this operation, and in the drop-down menu select Block.
- In the Group rules window click OK.

Perform the same actions described above with the High Restricted folder. Do not configure the options for the AntiWinLock resource in the folders Trusted and Untrusted
To restrict the applications not included into the Trusted group to change Internet Explorer security settings (as well as settings of the embedded Firewall and etc.), in the Applications window select the Low Restricted folder and at the top of the window click Edit.

In the Group rules window go to the Files and system registry tab.
In the Group rules window for the Security settings resource set the Block actions for the columns Read, Write, Delete, and Create the following way:
- Right-click the action in the column and in the context menu select Block.
- In the Group rules window click the OK button.

In the Applications window click the OK button.
In the Settings window click the OK button.
Close Kaspersky Internet Security 2013.

As a result a blocking action to address registry keys has been set for all programs not included into the Trusted group. If any threat occurs, Kaspersky Internet Security 2013 will block a dangerous action and log this action into a report.

2. For Kaspersky Internet Security 2012

It is very important to secure computer protection against malware belongning to the Trojan-Ransom family. In order to secure computer protection, a user can use the Application Control component from Kaspersky Internet Security 2011. The component registers all actions performed by applications run in the system and controls them according to special rules. These rules control applications' access to system resources.

In order to secure your computer protection, it is required to create a rule that will control applications' access to some registry keys. It is recommended to create rules for the following registry keys:

*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
*SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
*\SOFTWARE\Policies\*
*\SOFTWARE\Policies\*\
*\SOFTWARE\Policies\*\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*\*

In order to create rules for registry keys mentioned above, perform the following actions:

Open Kaspersky Internet Security 2012.
On the upper right hand corner of the main application window, click Settings.
On the upper part of the Settings window, go to the Protection Center tab and then select Application Control.
On the right hand part of the Settings window, click on the Identity protection button.
On the Digital Identity Protection window on the Identity data tab, select All resources from the drop-down list.
On the Identity data tab create a new category with the name AntiWinLock. In order to do this, perform the following actions:
- On the Digital Identity Protection window, select the Identity data resource.
- In the upper part of the Digital Identity Protection window, click the Add category button.
- In the Identity data category window, enter AntiWinLock.
- Click the OK button.
To make browsing more convenient click on the "-" icon for each category in the Digital Identity Protection window
Select the AntiWinLock category.
Add to the AntiWinLock category registry keys which are required to be controlled. In order to do so, perform the following actions:
- On the upper left hand corner of the Digital Identity Protection window, click on the Add button.
- From the drop-down menu that will open, select the Registry key item.

On the User resource window, enter the Name for the rule (it is not obligatory to enter the Name for the rule. When you select the required Path, the name will be specified automatically).
Enter the Path which will be controlled by Application Control. In order to do this, click on the Browse... button.
Perform the following actions:
- At the bottom of the window Select registry object enter the following:
- In the Key field: *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- In the Value field: Shell
- Click on the OK button.
- On the User resource window, click on the OK button.

Perform the same actions for the rest resources:
In the Key field enter *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, in the Value field enter AppInit_DLLs
In the Key field enter *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, in the Value field enter Userinit
In the Key field enter *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\* (DO NOT enter any data in the Value field of this key. By default, the value "*" will be specified automatically)
In the Key field enter *\SOFTWARE\Policies, in the Value field enter *, in the User Resource window in the Name field enter Winlock.policies.Values
In the Key field enter *\SOFTWARE\Policies\*, in the User Resource window in the Name field enter Winlock.policies.Keys
In the Key field enter *\SOFTWARE\Policies\*, in the Value field enter *, in the User Resource window in the Name field enter Winlock.policies.Sub
In the Key field enter HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot, in the Value field enter *, in the User Resource window in the Name field enter SafeBoot.Values
In the Key field enter HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*, in the User Resource window in the Name field enter SafeBoot.Keys
In the Key field enter HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*, in the Value field enter *, in the User Resource window in the Name field enter SafeBoot.Values.Sub

Once you have performed the actions described above, ten registry resources will be added to the AntiWinLock category and will be controlled by the Application Control component of Kaspersky Internet Security 2012.
Click on the OK button.

In the right hand part of the Settings window, click on the Applications button.
In the Applications window, perform the following actions:
- Select the Low Restricted folder.
- On the upper left hand part of the Applications window, click on the Edit button.
- On the Group rules window, go to the Files and system registry tab.
- Find the AntiWinLock resource.
- For the AntiWinLock resource the option Prompt for action is specified for the actions Read, Write, Delete and Create. Specify the Block option for the actions Read, Write, Delete and Create. In order to do this, perform the following actions:
  - Right-click the icon of the required action.
  - Select Block from the context menu that will open.
  - Click the OK button in the Group rules window.

Perform the same actions described above with the High Restricted folder.
Do not configure the options for the AntiWinLock resource in the folders Trusted and Untrusted.
Block access of applications, which are not in the Trusted group, to change the Internet Explorer security options, the Internet Explorer security zones, the options of the embedded Firewall. In order to do this, perform the following actions:
- On the Applications window, select the Low Restricted folder.
- On the upper left hand corner of the Applications window, click on the Edit button.
- On the Group rules window, go to the Files and system refistry tab.
- Specify the Block option for the Read, Write, Delete, Create actions of the Security settings resource. In order to do this:
  - Right-click the required icon of the required action in the Security settings line.
  - Select Block from the context menu that will open.
On the Group rules window, click on the OK button.

In the Applications window, click the OK button.
In the Settings window, click the OK button.
Close Kaspersky Internet Security 2012.

As a result a blocking action to address registry keys has been set for all programs not included into the Trusted group. If any threat occurs, Kaspersky Internet Security 2012 will block any dangerous action and log this action into a report.

3. For Kaspersky PURE 3.0

In order to secure computer protection, a user can use the Application Control component from Kaspersky PURE 3.0.
The component registers all actions performed by applications run in the system and controls them according to special rules. These rules control applications' access to system resources.
In order to secure your computer protection, it is required to create a rule that will control applications' access to some registry keys. It is recommended to create rules for the following registry keys:

*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*
*\SOFTWARE\Policies\*
*\SOFTWARE\Policies\*\
*\SOFTWARE\Policies\*\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\*\*

To create a rule, do the following: