SlideShare une entreprise Scribd logo
1  sur  12
Télécharger pour lire hors ligne
Why Traditional Anti-Malware
             Solutions Are No Longer Enough

                                   An overview of the threat landscape
                                   and how AVG 9.0 can help keep you
                                      and your business safe online




© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                                                                     October, 2009




Contents

Why you should read this paper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
The evolution of commercial malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Your identity: a valuable commodity in the underground economy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
The World Wide Web of deceit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Why your current security solution is not enough . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
AVG’s three layers of protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Why the third layer is so crucial today . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
            Combined Firewall, IDP, and AV Signature detections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
AVG 9: Choose Your Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
            For personal use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
            For business use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
About AVG Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
AVG on the Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
References               . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Corporate offices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12




                                                                                                                                                                                                                                                    2

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




Why you should read this paper

Security used to be a straightforward matter. Email was the primary attack vector and simply installing an anti-virus product
and exercising caution when opening attachments mitigated the majority of threats. When a system did become infected, the
consequences were not usually particularly dire; inconvenience and data loss were the most likely consequences. But times
have changed. The Web has become the attack vector of choice and today’s threats are rapidly evolving, stealthy and almost
always motivated by profit.

This paper provides an overview of the current threat landscape, explains why your current security solution is not enough,
and demonstrates how AVG 9.0 can close the gap.



The evolution of commercial malware

A decade ago, viruses and other forms of malware were authored primarily by young, attention-seeking amateur coders (script
kiddies or script bunnies) seeking to earn notoriety in underground hacker communities. The sole purpose of their malicious
programs was to inconvenience users by scrambling their data and/or making their computers unstable. While some of their
creations caused widespread disruption, the majority were relatively unsophisticated and easily detected and blocked.

The security landscape has, however, changed markedly during recent years. Organized criminal gangs realized that there was
money to be made from malware and recruited skilled programmers to create malicious programs. These programs were not
intended to cause disruption, but to enable the theft of money or data or both. This led to the creation of an underground
economy in which criminals can buy and sell both data and the programs that are used to steal that data. Kits such as MPack1
are sold as commercial software, complete with support and update options, and enable anybody – even people without
programming skills – to launch sophisticated attacks against unsuspecting users. Consequently, there has been an exponential
increase in both the number of attacks and the number of compromised systems. During 2008 alone, more than 1.5 million
new strains of malware were identified – which translates to tens of thousands of samples arriving in security companies’
research labs every day.

Security threats have also become increasingly complex and interlinked. For example, in the past spam was used to push little
blue pills and counterfeit software; but today it is used to push worms such as Storm2. When infected by the worm, computers
would be co-opted into the Storm botnet – a centrally controlled network which, at one time, consisted of up to 50 million
similarly compromised computers. Those computers would then be used, without the owner’s knowledge, to send out spam
emails to which the worm was attached in order to ensure the continued expansion of the botnet. Additionally, criminals
could rent time on the botnet and use it to send out their own scam emails. While the Storm botnet may now be dead, others -
such as Conficker3 – have already emerged to take its place.



Your identity: a valuable commodity in the underground economy

For millions of people, using                  “Web site attacks on browsers are increasingly targeting components, such as Flash and QuickTime, that are
                                               not automatically patched when the browser is patched. At the same time, web site attacks have migrated
a computer to make financial                   from simple ones based on exploits posted on a web site to more sophisticated attacks based on scripts
transactions has become                        that cycle through multiple exploits to even more sophisticated attacks that increasingly utilize packaged
                                               modules that can effectively disguise their payloads. One of the latest such modules, mpack, produces
as routine as brushing their                   a claimed 10-25% success rate in exploiting browsers that visit sites infected with the module. While all this
teeth. Consequently, today’s                   is happening, attackers are actively placing exploit code on popular, trusted web sites where users have
                                               an expectation of effective security. Placing better attack tools on trusted sites is giving attackers a huge
personal computers are                         advantage over the unwary public.”
used to store and transmit                                                                           SANS Institute, Top Ten Cyber Security Menaces for 20086




                                                                                                                                                                                     3

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




a large amount of personal information - and that makes them an extremely attractive target for criminals. If your computer is
compromised or its communications intercepted, an attacker may be able to establish your:

• Date of birth
• Social Security or other national identity number
• Online banking information and passwords
• Email address and passwords
• Mailing address
• Telephone number
• Employment details
In other words, your computer can provide a criminal with enough information to enable your identity to be stolen.

The return on cybercrime is not nickel and dime; on the contrary, it is a multi-billion dollar industry. A study by Javelin Strategy
and Research found that 9.9 million Americans lost a total of $48 billion to identity fraud in 20084. And according to Gartner,
a leading research and advisory company, phishing scams alone cost consumers $3.6 billion during 2007.



The World Wide Web of deceit

The Web has become the attack vector of choice. With email, attackers had only a limited number of ways to compromise
a computer: either with an infected attachment or with a link to a website which would deliver a malicious payload. While
attackers still use email, they have discovered that the Web in general – and social networks in particular - provides them
                                                         with a much broader range of options. Vulnerabilities in web browsers
  “The hallmark of today’s web-borne infections is ‘here and browser add-ons, such as Flash, QuickTime and Microsoft Silverlight,
  today, gone tomorrow’. Unlike LinkScanner, web
  security products that rely on visiting and scanning   provide backdoors which enable systems to be infected with keyloggers,
  websites to deliver a safety rating to users would     password-stealing Trojans and other forms of malware. And there is
  have to visit every one of the hundreds of millions of
  sites on the Internet every day to provide protection  certainly no shortage of those backdoors: Internet Explorer alone has had
  against these threats – a technological impossibility  more than 75 announced vulnerabilities in the last two years. The so-called
  even with today’s supercomputers.”
                       J.R. Smith, CEO, AVG Technologies
                                                         “social web” provides attackers with new mechanisms for attack such as
                                                         cross-site scripting in AJAX and RSS/Atom injection.

Compounding the problem is the fact that no website can be considered safe. Established and popular websites which users
would usually trust can be compromised and used as malware delivery vehicles without the site owner’s knowledge. Similarly,
advertisements can be designed to exploit vulnerabilities in web browsers and browser add-ons and distributed via advertising
networks across numerous websites. Such attacks have become extremely common. During the second half of 2008, 70 of the
world’s top 100 websites were found to have either been compromised or to contain links to other malicious websites7. In January
2009, thousands of websites – including sites belonging to Fortune 500 companies, federal agencies, embassies, celebrities and
even some security companies – were compromised and used to steal data from unsuspecting visitors8.



Why your current security solution is not enough

In order to be able to successfully extract data and/or money, cybercriminals need their malicious programs to remain
on computers undetected and, consequently, the destructive viruses of the past have been superseded by malware that
is much more stealthy. Today, simply visiting a trusted website can result in a computer being stripped of its sensitive
information without the user having a clue as to what has happened - until, that is, he finds that his online accounts have



                                                                                                                                                                                     4

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




been compromised or there are unexplained items on his credit card statement. But it is not only detection by users which
cybercriminals need to avoid in order for their schemes to succeed; it is detection by security products too – and they are
deploying increasingly sophisticated techniques in order to do just that.

To hide from search engines such as Google and from solutions like Site Advisor or phishing filter products – all of which
regularly scan the Web in an attempt to seek out and blacklist malicious sites - attackers use temporary websites which are
online for only a matter of hours before being taken down and the malicious content moved to a new website. Research by
AVG Technologies indicates that between 200,000 and 300,000 new infective websites come online each and every day. More
than half of such sites are live for less than 24 hours, but nonetheless they are able to infect a substantial number of computers
thanks to spam campaigns relayed through botnets and through social networking sites such as Facebook.

To detect malware, traditional security products rely on signatures. These signatures are byte sequences – or code snippets –
extracted from the original malware and are pushed out by vendors whenever a new piece of malware is discovered. Security
products use these signatures to perform pattern matching. Should a file be found to contain a byte sequence that matches
a signature in the security product’s database, it is classed as malware and the user notified. Consequently, cybercriminals
want to prevent security companies from obtaining their malware as, without a sample, they cannot release a signature – and
that means the malware will be able to remain undetected for longer and, accordingly, be able to infect more computers. To
keep malware out of the hands of security companies, its creators use a variety of techniques including browser and operating
system validation, download threshold restrictions and randomization. This means that websites can push different content to
different visitors: a security company’s automated search tools can be served content that is completely harmless, but a person
visiting the website with an unpatched browser can be served malicious content.

Even when security companies do obtain a sample of the malware, blocking it can be much harder than it was in the past.
Metamorphic10 and polymorphic11 coding techniques enable the creation of malware which can change its signature upon
each new infection. Similarly, some malware is encrypted in order to make it unreadable to anti-virus scanners (in such cases,
detection relies on being able to detect the presence of the decrypting module rather than the virus itself ).

Today’s sophisticated and rapidly evolving malware is beginning to expose the shortcomings of traditional signature-based
detection methods – and that’s putting users’ data at risk. Research by a security company in 2007 highlighted the extent
of the problem: 72% of company computers and 23% of home computers that ran signature-based security products were
found to be infected by malware. Research undertaken by CoreTrace in the summer of 2009 found that more than 50%
of companies consider signature-based protection to be inadequate against today’s threats.



AVG’s three layers of protection

Imagine your valuable data is stored on a square of card and that AVG’s three layers of protection are slices of Swiss cheese.

The first layer of protection is traditional anti-virus, which keeps known viruses, worms, spyware, and the like out of your
system by matching them to a database. The holes in this first layer of cheese are where unknown viruses and here-today,
gone-tomorrow web threats get in, because they’re not detected by the signatures in your anti-virus. In AVG 9, signature-
based scanning has been speeded up by marking files as safe or potentially unsafe during the initial scan, which enables the
scanner to skip the safe files in future scans unless the file structure changes. As a result, scan time is dramatically reduced– by
up to 50 percent depending on system configuration. AVG 9 also demonstrates improvements of 10 to 15 percent in both
boot times and memory usage.

The second layer of protection is represented by AVG’s LinkScanner® safe-surfing and safe-searching technology. LinkScanner
takes care of the here-today, gone tomorrow threats on the web by understanding and blocking the distribution methods the




                                                                                                                                                                                     5

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




bad guys use. It’s the only software to check the safety of a web page you’re about to go to at the only time that matters - right
at the time you’re going to go there.

Other programs will only tell you whether the web site in question was clean the last time they checked it – which might be
weeks or even months ago. Not too helpful when over 60% of web-based infections stay on the same site for less than 24 hours.

In AVG 9, LinkScanner delivers improved anti-phishing detection by more quickly and accurately determining whether
or not a web page is hosting a phishing attack. This is accomplished by allowing the software to apply more than 100
different potential threat indicators to a page. If the result is inconclusive, LinkScanner then makes a call to the cloud to
check a multitude of phishing feeds plugged into the AVG research network to make a final determination regarding threat
potential.

Now there are fewer holes.

The third and final layer is unique to AVG 9 and keeps your data safe against new and unknown threats. It does this through
co-operation between our Resident Shield, firewall, and identity protection modules, using cutting-edge technologies
like behavioral analysis, in-the-cloud testing, and application whitelisting. This co-operation enables the modules to share
malware information with each other, increasing our ability to detect and remove threats for which signatures have not yet
been issued.

Now all the holes are overlapped and nothing can get past your PC protection.

“If it looks like a duck, quacks like a duck and waddles like a duck, then it probably is a duck”. While this saying may seem
completely irrelevant to the subject of malware detection it is, in fact, anything but. In much the same way that a person can
identify a duck by its waddle and quack, a security product can identify malware by its behavioral characteristics. The process
is known as heuristic detection or heuristic analysis.

To be able to steal user data, malware must perform certain actions that would not normally be performed by a legitimate program.
For example, a legitimate program would not normally attempt to conceal its presence on a computer, inject code into another
program, log user keystrokes or access areas of the computer in which passwords are stored. By looking for such behaviors, heuristic
security products are able to identify potentially malicious programs and block them before they can cause any harm.

The main advantage of this approach is that the window of opportunity – that is, the time between a new piece of malware
being released and a signature for it being released – is completely eliminated. Accordingly, unlike signature-based products,
heuristic products are able to protect against both known and unknown threats.

This is the approach taken by AVG Identity Protection. AVG’s behavioral analysis technology detects and deactivates any
suspicious activity on your PC before it can cause damage. In addition, it all happens in the background, in real time, and with
minimal impact on system performance.

Benefits of Identity Protection’s behavioral analysis include:

• Identity theft prevention through detection and blocking of new and unknown threats such as rootkits, Trojans, and
  keyloggers
• An instant layer of continuous proactive protection without the need for signatures or scanning
• A false positive rate that’s 10 times lower than other behavior-based products
In AVG 9, Identity Protection is further enhanced by the ability to track malware installs through hi-jacked processes, which
significantly improves removal results, together with new behavior to detect malware that copies itself all over the machine.

Like LinkScanner, AVG Identity Protection does not require other AVG products to be installed and running. However, when
run with other AVG products, the combination delivers a highly effective layered security approach.



                                                                                                                                                                                     6

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




Why the third layer is so crucial today

No single detection mechanism can provide complete security: neither signature-based nor heuristic products are foolproof.
However, by implementing a combination of detection mechanisms, the chances of malware slipping by can be drastically reduced.

As noted earlier, AVG 9 now combines cutting-edge security technologies – behavioral, in-the-cloud, and whitelisting – to
optimize protection against today’s here-today, gone-tomorrow threats. These technologies come together through co-
operation between the Resident Shield, firewall, and identity protection modules. These modules communicate with each
other to provide malware information to each other, increasing the software’s ability to detect and remove threats for which
signature-based solutions along have not yet issued detections.

Here’s how it works.

The firewall has been completely redesigned to make use of application whitelisting, which reduces intrusive firewall alerts by
50%. The new firewall communicates behind the scenes with the behavioral detection technology in the identity protection
module to deliver the most accurate detection of new and unknown threats. AVG estimates that this approach delivers 90% fewer
false alarms than other products that are attempting to implement this approach. This enhanced protection level is particularly
effective against phishing threats through the use of “in-the-cloud” automated testing to detect tell-tale signs that indicate the
presence of a new threat. Because the earlier the software can detect a threat, the more effectively it can protect you.



Combined Firewall, IDP, and AV Signature detections

Each detection technology uses its own techniques for detecting potential threats; combining this information improves
overall detection. Here are some of the interactions and benefits:



Firewall and IDP

Whenever the firewall detects an attempted connection, it consults with IDP. If IDP has determined that this process is trusted
it will let the firewall know and thus not require the user to respond to a pop-up question. If IDP has determined that the
process is malicious, it automatically instructs the firewall to block all communications, thus reducing the chance of any
information leaking from the PC before the threat is quarantined. The process also works in reverse, when the communication
is used by IDP to help make a behavioral analysis.



Resident Shield and IDP

If Resident Shield detects a malicious file being installed, it passes that information to IDP. IDP uses this information to
determine whether any related components that might not be detected by Resident Shield are malicious and, if so, remove
them. Essentially, being associated with known malware is used as a behavioral characteristic, similar to the concept of guilt by
association.



In-the-Cloud Check Server and White Lists

Basically, whenever a process performs an activity deemed suspicious but with insufficient evidence to confirm it as malware,
that process is checked against the in-the-cloud service, which returns back whether this is a trusted, malicious, or unknown
process. If the process is trusted or malicious, appropriate actions are taken. If it’s unknown, the process continues to do what



                                                                                                                                                                                     7

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




it was doing, until such time as enough suspicious activity has accumulated to trigger detection. As and when that transpires,
the user will be asked to make a decision. If the user approves, the process will be submitted for additional analysis which
will in turn mark it as malicious or trusted. That information is then sent to the check service, so that all AVG customers’ PCs
that perform checks against this process will be notified immediately. This does several things. It allows for the detection of
malware before it gets too far in its activity, as well as preventing any false positives. The trust information is added to the
internal configuration, which is then distributed to all the agents as a configuration update, which is distributed periodically to
all agents.



AVG 9: Choose Your Security

For personal use

AVG Internet Security

Complete protection for everything you do

We know the things users like to do on their computers - surfing, shopping, banking, downloading and chatting with their
friends - so we developed AVG Internet Security to give them the multiple layers of protection they need to stay safe online.
Internet Security is constantly on alert, so they don’t have to be. Includes LinkScanner and Identity Protection.



AVG Anti-Virus

Essential protection that won’t get in your way

AVG Anti-Virus makes sure users’ computers stay free of viruses, spyware, and other malware. It includes AVG’s unique
LinkScanner technology to keep them safe from harmful web pages by scanning those pages right as users go to them.



AVG Identity Protection

Up-to-the-minute protection for online banking and shopping

The more time users spend online, the more important it is for them to keep their personal information secure. Anti-virus
alone is no longer enough to keep users safe when they’re shopping and banking online; whatever anti-virus they use, they
need the added security of AVG Identity Protection.

AVG LinkScanner and a less-automated, unsupported version of AVG Anti-Virus are available at no cost for home users
unwilling or unable to purchase the commercial products. Licenses are for one year.




                                                                                                                                                                                     8

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




For business use

AVG Internet Security Business Edition

Complete protection for your business

Internet Security Business Edition is faster, smarter security that won’t slow businesses down. AVG’s most advanced protection,
Internet Security 9.0 merges ground-breaking online threat prevention techniques with enhanced anti-virus and firewall
technologies to deliver proactive protection that’s second to none. Includes new Rescue CD network recovery toolkit.



AVG Anti-Virus Business Edition

Essential protection for your business

With AVG Anti-Virus Business Edition, companies get high-performance, next-generation scanning that doesn’t get in the way
of doing business. Plus, they get LinkScanner and enhanced phishing and firewall protection to keep the business safe while
employees are online. It’s easy to set up, easy to manage, and includes the new Rescue CD network recovery toolkit.



AVG File Server Edition

For businesses that already have anti-virus protection on their workstations but need protection for their file server, this is the
solution. Includes enhanced anti-virus scanner, LinkScanner web threat protection, and improved phishing detection.



AVG Email Server Edition

For businesses that already have anti-virus protection on their workstations and file server but need protection for their
email server, this is the solution. Includes enhanced anti-virus scanner, LinkScanner web threat protection, centralized spam
prevention, and improved phishing detection.



AVG Server Edition for Linux/FreeBSD

For any organization operating a Linux/FreeBSD Server, particularly for email, this is flexible, scalable protection against
infected email and attachments, including on the server itself. AVG supports all leading Linux and FreeBSD e-mail server
applications, including PostFix, QMail, Sendmail and Exim. Includes free client software.




                                                                                                                                                                                     9

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




About AVG Technologies

AVG is a global security solutions leader protecting more than 80 million consumers and small business computer users
in 167 countries from the ever-growing incidence of web threats, viruses, spam, cyber-scams and hackers on the Internet.
Headquartered in Amsterdam, AVG has nearly two decades of experience in combating cyber crime and one of the most
advanced laboratories for detecting, pre-empting and combating Web-borne threats from around the world. Its free online,
downloadable software model allows entry-level users to gain basic anti-virus protection and then to easily and inexpensively
upgrade to greater levels of safety and defense in both single and multi-user environments. Nearly 6,000 resellers, partners
and distributors team with AVG globally including Amazon.com, CNET, Cisco, Ingram Micro, Play.com, Wal-Mart, and Yahoo!.

To find out more about AVG Technologies and its products, please visit www.avg.com.



AVG on the Web

For up-to-the-minute news on the latest cyberthreats:
• Subscribe to AVG Chief Research Officer Roger Thompson’s blog at http://thompson.blog.avg.com/


For general AVG updates:
• Join our Facebook community at http://www.facebook.com/avgfree
• Follow AVG on Twitter www.twitter.com/officialavgnews
• Register at www.avgnews.com




                                                                                                                                                                                   10

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




References
1
 MPack:
http://en.wikipedia.org/wiki/MPack_(software)
2
 Storm worm:
http://en.wikipedia.org/wiki/Storm_Worm
3
 Conficker:
http://en.wikipedia.org/wiki/Conficker
4
 US ‘08 identity fraud up in total dollars, victims:
http://uk.reuters.com/article/marketsNewsUS/idUKN0646389320090209?pageNumber=1
5
 Pump and Dump Schemes:
http://www.sec.gov/answers/pumpdump.htm
6
 Top Ten Cyber Security Menaces for 2008
http://www.sans.org/2008menaces/
7
  70 Of Top 100 Web Sites Spread Malware
http://www.informationweek.com/news/internet/security/showArticle.jhtml?articleID=212901775)
8
 Hackers turn Cleveland into malware server
http://www.theregister.co.uk/2008/01/08/malicious_website_redirectors/
9
 Short-lived stealthy attacks are the new web threats
http://www.avg.com/press-releases-news.ndi-222533
10
  Metamorphic code
http://en.wikipedia.org/wiki/Metamorphic_code
11
  Polymorphic code
http://en.wikipedia.org/wiki/Polymorphic_code
12
  Malware Quietly Reaching ‘Epidemic’ Levels
http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=208803810




                                                                                                                                                                                   11

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
White Paper
                                                                                                                                                                October, 2009




Corporate offices


AVG Technologies CZ, s.r.o.                                   AVG Technologies USA, Inc.                                    AVG Technologies UK, Ltd.

Lidická 31, 602 00 Brno                                       1 Executive Drive, 3rd Floor                                  Glenholm Park, Brunel Drive
Czech Republic                                                Chelmsford, MA 01824                                          Newark, Nottinghamshire,
www.avg.cz                                                    USA                                                           NG24 2EG
                                                              www.avg.com                                                   United Kingdom
                                                                                                                            www.avg.co.uk


AVG Technologies GER GmbH                                     AVG Technologies CY Ltd.

Bernhard-Wicki-Str. 7                                         Arch. Makariou III.
80636 München                                                 2-4 Capital Centre
Deutschland                                                   1505, Nicosia, Cyprus
www.avg.de                                                    Fax: +357 224 100 33
                                                              www.avg.com



                                                                                                                                                                                   12

© 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.

Contenu connexe

En vedette

Make the right choices to create a winning strategy by Kenneth Mikkelsen
Make the right choices to create a winning strategy by Kenneth MikkelsenMake the right choices to create a winning strategy by Kenneth Mikkelsen
Make the right choices to create a winning strategy by Kenneth MikkelsenKenneth Mikkelsen
 
Coesc Esa 2010 Proposal
Coesc Esa 2010 ProposalCoesc Esa 2010 Proposal
Coesc Esa 2010 Proposalcoesc
 
Монетизация базы клиентов
Монетизация базы клиентовМонетизация базы клиентов
Монетизация базы клиентов"EXILEM" marketing agency
 
JC2 Picture Your Vision
JC2 Picture Your VisionJC2 Picture Your Vision
JC2 Picture Your Visionmjc.chrystal
 
Buildor Techsummit
Buildor TechsummitBuildor Techsummit
Buildor Techsummitbuildor
 
Luftrom, Luftromsendring og Luftromskrenkelser
Luftrom, Luftromsendring og LuftromskrenkelserLuftrom, Luftromsendring og Luftromskrenkelser
Luftrom, Luftromsendring og LuftromskrenkelserRoe Nerem, Avinor
 
Podnikatelka Slovenska 2008 Vitazky
Podnikatelka Slovenska 2008 VitazkyPodnikatelka Slovenska 2008 Vitazky
Podnikatelka Slovenska 2008 VitazkyNadsme
 
Uu 2008 20_tentang_usaha_mikro_kecil_dan_menengah
Uu 2008 20_tentang_usaha_mikro_kecil_dan_menengahUu 2008 20_tentang_usaha_mikro_kecil_dan_menengah
Uu 2008 20_tentang_usaha_mikro_kecil_dan_menengahAris Lazuardi
 
Antonio Rincón
Antonio RincónAntonio Rincón
Antonio Rincónidobnocnir
 
I care 2011 – red 1
I care 2011 – red 1I care 2011 – red 1
I care 2011 – red 1Mike Relf
 
Juknis akreditasi sd-mi
Juknis akreditasi sd-miJuknis akreditasi sd-mi
Juknis akreditasi sd-miHARLAN
 

En vedette (20)

Make the right choices to create a winning strategy by Kenneth Mikkelsen
Make the right choices to create a winning strategy by Kenneth MikkelsenMake the right choices to create a winning strategy by Kenneth Mikkelsen
Make the right choices to create a winning strategy by Kenneth Mikkelsen
 
Energy3
Energy3Energy3
Energy3
 
Coesc Esa 2010 Proposal
Coesc Esa 2010 ProposalCoesc Esa 2010 Proposal
Coesc Esa 2010 Proposal
 
Монетизация базы клиентов
Монетизация базы клиентовМонетизация базы клиентов
Монетизация базы клиентов
 
JC2 Picture Your Vision
JC2 Picture Your VisionJC2 Picture Your Vision
JC2 Picture Your Vision
 
Buildor Techsummit
Buildor TechsummitBuildor Techsummit
Buildor Techsummit
 
Astronomy np3 outline
Astronomy np3 outlineAstronomy np3 outline
Astronomy np3 outline
 
Luftrom, Luftromsendring og Luftromskrenkelser
Luftrom, Luftromsendring og LuftromskrenkelserLuftrom, Luftromsendring og Luftromskrenkelser
Luftrom, Luftromsendring og Luftromskrenkelser
 
Student travel-guide
Student travel-guideStudent travel-guide
Student travel-guide
 
Podnikatelka Slovenska 2008 Vitazky
Podnikatelka Slovenska 2008 VitazkyPodnikatelka Slovenska 2008 Vitazky
Podnikatelka Slovenska 2008 Vitazky
 
Telly Chakkar
Telly ChakkarTelly Chakkar
Telly Chakkar
 
10 Teps to SOA
10 Teps to SOA10 Teps to SOA
10 Teps to SOA
 
Eccentricity practice hw
Eccentricity practice hwEccentricity practice hw
Eccentricity practice hw
 
Uu 2008 20_tentang_usaha_mikro_kecil_dan_menengah
Uu 2008 20_tentang_usaha_mikro_kecil_dan_menengahUu 2008 20_tentang_usaha_mikro_kecil_dan_menengah
Uu 2008 20_tentang_usaha_mikro_kecil_dan_menengah
 
Antonio Rincón
Antonio RincónAntonio Rincón
Antonio Rincón
 
Welcome to 8th Grade Science
Welcome to 8th Grade ScienceWelcome to 8th Grade Science
Welcome to 8th Grade Science
 
dssi 10 12
dssi 10 12dssi 10 12
dssi 10 12
 
I care 2011 – red 1
I care 2011 – red 1I care 2011 – red 1
I care 2011 – red 1
 
Imperfect
ImperfectImperfect
Imperfect
 
Juknis akreditasi sd-mi
Juknis akreditasi sd-miJuknis akreditasi sd-mi
Juknis akreditasi sd-mi
 

Similaire à Why Traditional Anti Malware Whitepaper

15466 mba technology_white_paper
15466 mba technology_white_paper15466 mba technology_white_paper
15466 mba technology_white_paperMD ASAD KHAN
 
15466 mba technology_white_paper
15466 mba technology_white_paper15466 mba technology_white_paper
15466 mba technology_white_paperwardell henley
 
VeraCode State of software security report volume5 2013
VeraCode State of software security report volume5 2013VeraCode State of software security report volume5 2013
VeraCode State of software security report volume5 2013Cristiano Caetano
 
Motive_Security_Labs_Malware_Report_1H2015
Motive_Security_Labs_Malware_Report_1H2015Motive_Security_Labs_Malware_Report_1H2015
Motive_Security_Labs_Malware_Report_1H2015Gordon Henderson
 
Objective briefing on the current mobile threat 2010/2011
Objective briefing on the current mobile threat 2010/2011Objective briefing on the current mobile threat 2010/2011
Objective briefing on the current mobile threat 2010/2011Транслируем.бел
 
Cloudy Wpcybersecurity
Cloudy WpcybersecurityCloudy Wpcybersecurity
Cloudy Wpcybersecurityathkeb
 
90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf
90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf
90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdfmoon722835
 
The Best Practices of Symantec Code Signing - RapidSSLonline
The Best Practices of Symantec Code Signing - RapidSSLonlineThe Best Practices of Symantec Code Signing - RapidSSLonline
The Best Practices of Symantec Code Signing - RapidSSLonlineRapidSSLOnline.com
 
2020-trustwave-global-security-report.pdf
2020-trustwave-global-security-report.pdf2020-trustwave-global-security-report.pdf
2020-trustwave-global-security-report.pdfOscarMauricioHernand9
 
Enhancing intelligence with the Internet of Things
Enhancing intelligence with the Internet of ThingsEnhancing intelligence with the Internet of Things
Enhancing intelligence with the Internet of ThingsThe Marketing Distillery
 
Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...
Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...
Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...UltraUploader
 
Alternatives for-securing-virtual-networks
Alternatives for-securing-virtual-networksAlternatives for-securing-virtual-networks
Alternatives for-securing-virtual-networksJustin Cletus
 
Securing your mobile business with ibm worklight
Securing your mobile business with ibm worklightSecuring your mobile business with ibm worklight
Securing your mobile business with ibm worklightbupbechanhgmail
 
Microsoft Security Intelligence Report vol. 21
Microsoft Security Intelligence Report vol. 21Microsoft Security Intelligence Report vol. 21
Microsoft Security Intelligence Report vol. 21Ioannis Aligizakis, M.Sc.
 
Internet of Things - Enablement by Techcello
Internet of Things - Enablement by TechcelloInternet of Things - Enablement by Techcello
Internet of Things - Enablement by TechcelloIlyas F ☁☁☁
 
The notorious nine_cloud_computing_top_threats_in_2013
The notorious nine_cloud_computing_top_threats_in_2013The notorious nine_cloud_computing_top_threats_in_2013
The notorious nine_cloud_computing_top_threats_in_2013Vinoth Sivasubramanan
 
Nominum 2017 Spring Data Revelations Security Report
Nominum 2017 Spring Data Revelations Security ReportNominum 2017 Spring Data Revelations Security Report
Nominum 2017 Spring Data Revelations Security ReportYuriy Yuzifovich
 
top-50-cybersecurity-threats.pdf
top-50-cybersecurity-threats.pdftop-50-cybersecurity-threats.pdf
top-50-cybersecurity-threats.pdfnowplanettv1
 
State of Software Security - Public Companies Supplement
State of Software Security - Public Companies SupplementState of Software Security - Public Companies Supplement
State of Software Security - Public Companies Supplementstemkat
 

Similaire à Why Traditional Anti Malware Whitepaper (20)

Stopping Malware
Stopping MalwareStopping Malware
Stopping Malware
 
15466 mba technology_white_paper
15466 mba technology_white_paper15466 mba technology_white_paper
15466 mba technology_white_paper
 
15466 mba technology_white_paper
15466 mba technology_white_paper15466 mba technology_white_paper
15466 mba technology_white_paper
 
VeraCode State of software security report volume5 2013
VeraCode State of software security report volume5 2013VeraCode State of software security report volume5 2013
VeraCode State of software security report volume5 2013
 
Motive_Security_Labs_Malware_Report_1H2015
Motive_Security_Labs_Malware_Report_1H2015Motive_Security_Labs_Malware_Report_1H2015
Motive_Security_Labs_Malware_Report_1H2015
 
Objective briefing on the current mobile threat 2010/2011
Objective briefing on the current mobile threat 2010/2011Objective briefing on the current mobile threat 2010/2011
Objective briefing on the current mobile threat 2010/2011
 
Cloudy Wpcybersecurity
Cloudy WpcybersecurityCloudy Wpcybersecurity
Cloudy Wpcybersecurity
 
90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf
90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf
90_javacodegeeks_w_wile405_rp0xFI8mPG7KGcrbjmcEsA.pdf
 
The Best Practices of Symantec Code Signing - RapidSSLonline
The Best Practices of Symantec Code Signing - RapidSSLonlineThe Best Practices of Symantec Code Signing - RapidSSLonline
The Best Practices of Symantec Code Signing - RapidSSLonline
 
2020-trustwave-global-security-report.pdf
2020-trustwave-global-security-report.pdf2020-trustwave-global-security-report.pdf
2020-trustwave-global-security-report.pdf
 
Enhancing intelligence with the Internet of Things
Enhancing intelligence with the Internet of ThingsEnhancing intelligence with the Internet of Things
Enhancing intelligence with the Internet of Things
 
Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...
Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...
Blended attacks exploits, vulnerabilities and buffer overflow techniques in c...
 
Alternatives for-securing-virtual-networks
Alternatives for-securing-virtual-networksAlternatives for-securing-virtual-networks
Alternatives for-securing-virtual-networks
 
Securing your mobile business with ibm worklight
Securing your mobile business with ibm worklightSecuring your mobile business with ibm worklight
Securing your mobile business with ibm worklight
 
Microsoft Security Intelligence Report vol. 21
Microsoft Security Intelligence Report vol. 21Microsoft Security Intelligence Report vol. 21
Microsoft Security Intelligence Report vol. 21
 
Internet of Things - Enablement by Techcello
Internet of Things - Enablement by TechcelloInternet of Things - Enablement by Techcello
Internet of Things - Enablement by Techcello
 
The notorious nine_cloud_computing_top_threats_in_2013
The notorious nine_cloud_computing_top_threats_in_2013The notorious nine_cloud_computing_top_threats_in_2013
The notorious nine_cloud_computing_top_threats_in_2013
 
Nominum 2017 Spring Data Revelations Security Report
Nominum 2017 Spring Data Revelations Security ReportNominum 2017 Spring Data Revelations Security Report
Nominum 2017 Spring Data Revelations Security Report
 
top-50-cybersecurity-threats.pdf
top-50-cybersecurity-threats.pdftop-50-cybersecurity-threats.pdf
top-50-cybersecurity-threats.pdf
 
State of Software Security - Public Companies Supplement
State of Software Security - Public Companies SupplementState of Software Security - Public Companies Supplement
State of Software Security - Public Companies Supplement
 

Plus de AVG Technologies

Android performance optimization_guide_h1 2016
Android performance optimization_guide_h1 2016Android performance optimization_guide_h1 2016
Android performance optimization_guide_h1 2016AVG Technologies
 
Avg technologies android app_performance__trends_report_h1 2016
Avg technologies android app_performance__trends_report_h1 2016Avg technologies android app_performance__trends_report_h1 2016
Avg technologies android app_performance__trends_report_h1 2016AVG Technologies
 
AVG Android App Report Q3 2015
AVG Android App Report Q3 2015AVG Android App Report Q3 2015
AVG Android App Report Q3 2015AVG Technologies
 
Weather Forecast for Today? Advert Flood Coming from East
Weather Forecast for Today? Advert Flood Coming from EastWeather Forecast for Today? Advert Flood Coming from East
Weather Forecast for Today? Advert Flood Coming from EastAVG Technologies
 
AVG Android App Performance Report Q1 2015
AVG Android App Performance Report Q1 2015AVG Android App Performance Report Q1 2015
AVG Android App Performance Report Q1 2015AVG Technologies
 
Avg Technologies Vawtrak Banking Trojan White Paper
Avg Technologies Vawtrak Banking Trojan White PaperAvg Technologies Vawtrak Banking Trojan White Paper
Avg Technologies Vawtrak Banking Trojan White PaperAVG Technologies
 
AVG Android App Performance Report Q4 2014
AVG Android App Performance Report Q4 2014AVG Android App Performance Report Q4 2014
AVG Android App Performance Report Q4 2014AVG Technologies
 
MEF Global Consumer Trust Report
MEF Global Consumer Trust ReportMEF Global Consumer Trust Report
MEF Global Consumer Trust ReportAVG Technologies
 
AVG Android App Performance Report by AVG Technologies
AVG Android App Performance Report by AVG TechnologiesAVG Android App Performance Report by AVG Technologies
AVG Android App Performance Report by AVG TechnologiesAVG Technologies
 
AVG Protection Reviewer's Guide 2015
AVG Protection Reviewer's Guide 2015AVG Protection Reviewer's Guide 2015
AVG Protection Reviewer's Guide 2015AVG Technologies
 
Tony Anscombe CIS Keynote 2014
Tony Anscombe CIS Keynote 2014Tony Anscombe CIS Keynote 2014
Tony Anscombe CIS Keynote 2014AVG Technologies
 
AVG CIS 2014 Resource Sheet
AVG CIS 2014 Resource SheetAVG CIS 2014 Resource Sheet
AVG CIS 2014 Resource SheetAVG Technologies
 
Tony Anscombe Seminar CIS 2014
Tony Anscombe Seminar CIS 2014Tony Anscombe Seminar CIS 2014
Tony Anscombe Seminar CIS 2014AVG Technologies
 
Yuval Ben-Itzhak Seminar CIS 2014
Yuval Ben-Itzhak Seminar CIS 2014Yuval Ben-Itzhak Seminar CIS 2014
Yuval Ben-Itzhak Seminar CIS 2014AVG Technologies
 
AVG CloudCare Content Filtering Fact Sheet
AVG CloudCare Content Filtering Fact SheetAVG CloudCare Content Filtering Fact Sheet
AVG CloudCare Content Filtering Fact SheetAVG Technologies
 
AVG Internet of Things Survey Oct 2014
AVG Internet of Things Survey Oct 2014AVG Internet of Things Survey Oct 2014
AVG Internet of Things Survey Oct 2014AVG Technologies
 
AVG PC TuneUp Whitepaper 2015
AVG PC TuneUp Whitepaper 2015AVG PC TuneUp Whitepaper 2015
AVG PC TuneUp Whitepaper 2015AVG Technologies
 
AVG Cleaner for Mac Whitepaper 2015
AVG Cleaner for Mac Whitepaper 2015AVG Cleaner for Mac Whitepaper 2015
AVG Cleaner for Mac Whitepaper 2015AVG Technologies
 
AVG Cleaner for iPhone and iPad Whitepaper 2015
AVG Cleaner for iPhone and iPad Whitepaper 2015AVG Cleaner for iPhone and iPad Whitepaper 2015
AVG Cleaner for iPhone and iPad Whitepaper 2015AVG Technologies
 
AVG Android Cleaner Whitepaper 2015
AVG Android Cleaner Whitepaper 2015AVG Android Cleaner Whitepaper 2015
AVG Android Cleaner Whitepaper 2015AVG Technologies
 

Plus de AVG Technologies (20)

Android performance optimization_guide_h1 2016
Android performance optimization_guide_h1 2016Android performance optimization_guide_h1 2016
Android performance optimization_guide_h1 2016
 
Avg technologies android app_performance__trends_report_h1 2016
Avg technologies android app_performance__trends_report_h1 2016Avg technologies android app_performance__trends_report_h1 2016
Avg technologies android app_performance__trends_report_h1 2016
 
AVG Android App Report Q3 2015
AVG Android App Report Q3 2015AVG Android App Report Q3 2015
AVG Android App Report Q3 2015
 
Weather Forecast for Today? Advert Flood Coming from East
Weather Forecast for Today? Advert Flood Coming from EastWeather Forecast for Today? Advert Flood Coming from East
Weather Forecast for Today? Advert Flood Coming from East
 
AVG Android App Performance Report Q1 2015
AVG Android App Performance Report Q1 2015AVG Android App Performance Report Q1 2015
AVG Android App Performance Report Q1 2015
 
Avg Technologies Vawtrak Banking Trojan White Paper
Avg Technologies Vawtrak Banking Trojan White PaperAvg Technologies Vawtrak Banking Trojan White Paper
Avg Technologies Vawtrak Banking Trojan White Paper
 
AVG Android App Performance Report Q4 2014
AVG Android App Performance Report Q4 2014AVG Android App Performance Report Q4 2014
AVG Android App Performance Report Q4 2014
 
MEF Global Consumer Trust Report
MEF Global Consumer Trust ReportMEF Global Consumer Trust Report
MEF Global Consumer Trust Report
 
AVG Android App Performance Report by AVG Technologies
AVG Android App Performance Report by AVG TechnologiesAVG Android App Performance Report by AVG Technologies
AVG Android App Performance Report by AVG Technologies
 
AVG Protection Reviewer's Guide 2015
AVG Protection Reviewer's Guide 2015AVG Protection Reviewer's Guide 2015
AVG Protection Reviewer's Guide 2015
 
Tony Anscombe CIS Keynote 2014
Tony Anscombe CIS Keynote 2014Tony Anscombe CIS Keynote 2014
Tony Anscombe CIS Keynote 2014
 
AVG CIS 2014 Resource Sheet
AVG CIS 2014 Resource SheetAVG CIS 2014 Resource Sheet
AVG CIS 2014 Resource Sheet
 
Tony Anscombe Seminar CIS 2014
Tony Anscombe Seminar CIS 2014Tony Anscombe Seminar CIS 2014
Tony Anscombe Seminar CIS 2014
 
Yuval Ben-Itzhak Seminar CIS 2014
Yuval Ben-Itzhak Seminar CIS 2014Yuval Ben-Itzhak Seminar CIS 2014
Yuval Ben-Itzhak Seminar CIS 2014
 
AVG CloudCare Content Filtering Fact Sheet
AVG CloudCare Content Filtering Fact SheetAVG CloudCare Content Filtering Fact Sheet
AVG CloudCare Content Filtering Fact Sheet
 
AVG Internet of Things Survey Oct 2014
AVG Internet of Things Survey Oct 2014AVG Internet of Things Survey Oct 2014
AVG Internet of Things Survey Oct 2014
 
AVG PC TuneUp Whitepaper 2015
AVG PC TuneUp Whitepaper 2015AVG PC TuneUp Whitepaper 2015
AVG PC TuneUp Whitepaper 2015
 
AVG Cleaner for Mac Whitepaper 2015
AVG Cleaner for Mac Whitepaper 2015AVG Cleaner for Mac Whitepaper 2015
AVG Cleaner for Mac Whitepaper 2015
 
AVG Cleaner for iPhone and iPad Whitepaper 2015
AVG Cleaner for iPhone and iPad Whitepaper 2015AVG Cleaner for iPhone and iPad Whitepaper 2015
AVG Cleaner for iPhone and iPad Whitepaper 2015
 
AVG Android Cleaner Whitepaper 2015
AVG Android Cleaner Whitepaper 2015AVG Android Cleaner Whitepaper 2015
AVG Android Cleaner Whitepaper 2015
 

Why Traditional Anti Malware Whitepaper

  • 1. Why Traditional Anti-Malware Solutions Are No Longer Enough An overview of the threat landscape and how AVG 9.0 can help keep you and your business safe online © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 2. White Paper October, 2009 Contents Why you should read this paper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 The evolution of commercial malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Your identity: a valuable commodity in the underground economy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 The World Wide Web of deceit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Why your current security solution is not enough . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 AVG’s three layers of protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Why the third layer is so crucial today . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Combined Firewall, IDP, and AV Signature detections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 AVG 9: Choose Your Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 For personal use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 For business use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 About AVG Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 AVG on the Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Corporate offices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 3. White Paper October, 2009 Why you should read this paper Security used to be a straightforward matter. Email was the primary attack vector and simply installing an anti-virus product and exercising caution when opening attachments mitigated the majority of threats. When a system did become infected, the consequences were not usually particularly dire; inconvenience and data loss were the most likely consequences. But times have changed. The Web has become the attack vector of choice and today’s threats are rapidly evolving, stealthy and almost always motivated by profit. This paper provides an overview of the current threat landscape, explains why your current security solution is not enough, and demonstrates how AVG 9.0 can close the gap. The evolution of commercial malware A decade ago, viruses and other forms of malware were authored primarily by young, attention-seeking amateur coders (script kiddies or script bunnies) seeking to earn notoriety in underground hacker communities. The sole purpose of their malicious programs was to inconvenience users by scrambling their data and/or making their computers unstable. While some of their creations caused widespread disruption, the majority were relatively unsophisticated and easily detected and blocked. The security landscape has, however, changed markedly during recent years. Organized criminal gangs realized that there was money to be made from malware and recruited skilled programmers to create malicious programs. These programs were not intended to cause disruption, but to enable the theft of money or data or both. This led to the creation of an underground economy in which criminals can buy and sell both data and the programs that are used to steal that data. Kits such as MPack1 are sold as commercial software, complete with support and update options, and enable anybody – even people without programming skills – to launch sophisticated attacks against unsuspecting users. Consequently, there has been an exponential increase in both the number of attacks and the number of compromised systems. During 2008 alone, more than 1.5 million new strains of malware were identified – which translates to tens of thousands of samples arriving in security companies’ research labs every day. Security threats have also become increasingly complex and interlinked. For example, in the past spam was used to push little blue pills and counterfeit software; but today it is used to push worms such as Storm2. When infected by the worm, computers would be co-opted into the Storm botnet – a centrally controlled network which, at one time, consisted of up to 50 million similarly compromised computers. Those computers would then be used, without the owner’s knowledge, to send out spam emails to which the worm was attached in order to ensure the continued expansion of the botnet. Additionally, criminals could rent time on the botnet and use it to send out their own scam emails. While the Storm botnet may now be dead, others - such as Conficker3 – have already emerged to take its place. Your identity: a valuable commodity in the underground economy For millions of people, using “Web site attacks on browsers are increasingly targeting components, such as Flash and QuickTime, that are not automatically patched when the browser is patched. At the same time, web site attacks have migrated a computer to make financial from simple ones based on exploits posted on a web site to more sophisticated attacks based on scripts transactions has become that cycle through multiple exploits to even more sophisticated attacks that increasingly utilize packaged modules that can effectively disguise their payloads. One of the latest such modules, mpack, produces as routine as brushing their a claimed 10-25% success rate in exploiting browsers that visit sites infected with the module. While all this teeth. Consequently, today’s is happening, attackers are actively placing exploit code on popular, trusted web sites where users have an expectation of effective security. Placing better attack tools on trusted sites is giving attackers a huge personal computers are advantage over the unwary public.” used to store and transmit SANS Institute, Top Ten Cyber Security Menaces for 20086 3 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 4. White Paper October, 2009 a large amount of personal information - and that makes them an extremely attractive target for criminals. If your computer is compromised or its communications intercepted, an attacker may be able to establish your: • Date of birth • Social Security or other national identity number • Online banking information and passwords • Email address and passwords • Mailing address • Telephone number • Employment details In other words, your computer can provide a criminal with enough information to enable your identity to be stolen. The return on cybercrime is not nickel and dime; on the contrary, it is a multi-billion dollar industry. A study by Javelin Strategy and Research found that 9.9 million Americans lost a total of $48 billion to identity fraud in 20084. And according to Gartner, a leading research and advisory company, phishing scams alone cost consumers $3.6 billion during 2007. The World Wide Web of deceit The Web has become the attack vector of choice. With email, attackers had only a limited number of ways to compromise a computer: either with an infected attachment or with a link to a website which would deliver a malicious payload. While attackers still use email, they have discovered that the Web in general – and social networks in particular - provides them with a much broader range of options. Vulnerabilities in web browsers “The hallmark of today’s web-borne infections is ‘here and browser add-ons, such as Flash, QuickTime and Microsoft Silverlight, today, gone tomorrow’. Unlike LinkScanner, web security products that rely on visiting and scanning provide backdoors which enable systems to be infected with keyloggers, websites to deliver a safety rating to users would password-stealing Trojans and other forms of malware. And there is have to visit every one of the hundreds of millions of sites on the Internet every day to provide protection certainly no shortage of those backdoors: Internet Explorer alone has had against these threats – a technological impossibility more than 75 announced vulnerabilities in the last two years. The so-called even with today’s supercomputers.” J.R. Smith, CEO, AVG Technologies “social web” provides attackers with new mechanisms for attack such as cross-site scripting in AJAX and RSS/Atom injection. Compounding the problem is the fact that no website can be considered safe. Established and popular websites which users would usually trust can be compromised and used as malware delivery vehicles without the site owner’s knowledge. Similarly, advertisements can be designed to exploit vulnerabilities in web browsers and browser add-ons and distributed via advertising networks across numerous websites. Such attacks have become extremely common. During the second half of 2008, 70 of the world’s top 100 websites were found to have either been compromised or to contain links to other malicious websites7. In January 2009, thousands of websites – including sites belonging to Fortune 500 companies, federal agencies, embassies, celebrities and even some security companies – were compromised and used to steal data from unsuspecting visitors8. Why your current security solution is not enough In order to be able to successfully extract data and/or money, cybercriminals need their malicious programs to remain on computers undetected and, consequently, the destructive viruses of the past have been superseded by malware that is much more stealthy. Today, simply visiting a trusted website can result in a computer being stripped of its sensitive information without the user having a clue as to what has happened - until, that is, he finds that his online accounts have 4 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 5. White Paper October, 2009 been compromised or there are unexplained items on his credit card statement. But it is not only detection by users which cybercriminals need to avoid in order for their schemes to succeed; it is detection by security products too – and they are deploying increasingly sophisticated techniques in order to do just that. To hide from search engines such as Google and from solutions like Site Advisor or phishing filter products – all of which regularly scan the Web in an attempt to seek out and blacklist malicious sites - attackers use temporary websites which are online for only a matter of hours before being taken down and the malicious content moved to a new website. Research by AVG Technologies indicates that between 200,000 and 300,000 new infective websites come online each and every day. More than half of such sites are live for less than 24 hours, but nonetheless they are able to infect a substantial number of computers thanks to spam campaigns relayed through botnets and through social networking sites such as Facebook. To detect malware, traditional security products rely on signatures. These signatures are byte sequences – or code snippets – extracted from the original malware and are pushed out by vendors whenever a new piece of malware is discovered. Security products use these signatures to perform pattern matching. Should a file be found to contain a byte sequence that matches a signature in the security product’s database, it is classed as malware and the user notified. Consequently, cybercriminals want to prevent security companies from obtaining their malware as, without a sample, they cannot release a signature – and that means the malware will be able to remain undetected for longer and, accordingly, be able to infect more computers. To keep malware out of the hands of security companies, its creators use a variety of techniques including browser and operating system validation, download threshold restrictions and randomization. This means that websites can push different content to different visitors: a security company’s automated search tools can be served content that is completely harmless, but a person visiting the website with an unpatched browser can be served malicious content. Even when security companies do obtain a sample of the malware, blocking it can be much harder than it was in the past. Metamorphic10 and polymorphic11 coding techniques enable the creation of malware which can change its signature upon each new infection. Similarly, some malware is encrypted in order to make it unreadable to anti-virus scanners (in such cases, detection relies on being able to detect the presence of the decrypting module rather than the virus itself ). Today’s sophisticated and rapidly evolving malware is beginning to expose the shortcomings of traditional signature-based detection methods – and that’s putting users’ data at risk. Research by a security company in 2007 highlighted the extent of the problem: 72% of company computers and 23% of home computers that ran signature-based security products were found to be infected by malware. Research undertaken by CoreTrace in the summer of 2009 found that more than 50% of companies consider signature-based protection to be inadequate against today’s threats. AVG’s three layers of protection Imagine your valuable data is stored on a square of card and that AVG’s three layers of protection are slices of Swiss cheese. The first layer of protection is traditional anti-virus, which keeps known viruses, worms, spyware, and the like out of your system by matching them to a database. The holes in this first layer of cheese are where unknown viruses and here-today, gone-tomorrow web threats get in, because they’re not detected by the signatures in your anti-virus. In AVG 9, signature- based scanning has been speeded up by marking files as safe or potentially unsafe during the initial scan, which enables the scanner to skip the safe files in future scans unless the file structure changes. As a result, scan time is dramatically reduced– by up to 50 percent depending on system configuration. AVG 9 also demonstrates improvements of 10 to 15 percent in both boot times and memory usage. The second layer of protection is represented by AVG’s LinkScanner® safe-surfing and safe-searching technology. LinkScanner takes care of the here-today, gone tomorrow threats on the web by understanding and blocking the distribution methods the 5 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 6. White Paper October, 2009 bad guys use. It’s the only software to check the safety of a web page you’re about to go to at the only time that matters - right at the time you’re going to go there. Other programs will only tell you whether the web site in question was clean the last time they checked it – which might be weeks or even months ago. Not too helpful when over 60% of web-based infections stay on the same site for less than 24 hours. In AVG 9, LinkScanner delivers improved anti-phishing detection by more quickly and accurately determining whether or not a web page is hosting a phishing attack. This is accomplished by allowing the software to apply more than 100 different potential threat indicators to a page. If the result is inconclusive, LinkScanner then makes a call to the cloud to check a multitude of phishing feeds plugged into the AVG research network to make a final determination regarding threat potential. Now there are fewer holes. The third and final layer is unique to AVG 9 and keeps your data safe against new and unknown threats. It does this through co-operation between our Resident Shield, firewall, and identity protection modules, using cutting-edge technologies like behavioral analysis, in-the-cloud testing, and application whitelisting. This co-operation enables the modules to share malware information with each other, increasing our ability to detect and remove threats for which signatures have not yet been issued. Now all the holes are overlapped and nothing can get past your PC protection. “If it looks like a duck, quacks like a duck and waddles like a duck, then it probably is a duck”. While this saying may seem completely irrelevant to the subject of malware detection it is, in fact, anything but. In much the same way that a person can identify a duck by its waddle and quack, a security product can identify malware by its behavioral characteristics. The process is known as heuristic detection or heuristic analysis. To be able to steal user data, malware must perform certain actions that would not normally be performed by a legitimate program. For example, a legitimate program would not normally attempt to conceal its presence on a computer, inject code into another program, log user keystrokes or access areas of the computer in which passwords are stored. By looking for such behaviors, heuristic security products are able to identify potentially malicious programs and block them before they can cause any harm. The main advantage of this approach is that the window of opportunity – that is, the time between a new piece of malware being released and a signature for it being released – is completely eliminated. Accordingly, unlike signature-based products, heuristic products are able to protect against both known and unknown threats. This is the approach taken by AVG Identity Protection. AVG’s behavioral analysis technology detects and deactivates any suspicious activity on your PC before it can cause damage. In addition, it all happens in the background, in real time, and with minimal impact on system performance. Benefits of Identity Protection’s behavioral analysis include: • Identity theft prevention through detection and blocking of new and unknown threats such as rootkits, Trojans, and keyloggers • An instant layer of continuous proactive protection without the need for signatures or scanning • A false positive rate that’s 10 times lower than other behavior-based products In AVG 9, Identity Protection is further enhanced by the ability to track malware installs through hi-jacked processes, which significantly improves removal results, together with new behavior to detect malware that copies itself all over the machine. Like LinkScanner, AVG Identity Protection does not require other AVG products to be installed and running. However, when run with other AVG products, the combination delivers a highly effective layered security approach. 6 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 7. White Paper October, 2009 Why the third layer is so crucial today No single detection mechanism can provide complete security: neither signature-based nor heuristic products are foolproof. However, by implementing a combination of detection mechanisms, the chances of malware slipping by can be drastically reduced. As noted earlier, AVG 9 now combines cutting-edge security technologies – behavioral, in-the-cloud, and whitelisting – to optimize protection against today’s here-today, gone-tomorrow threats. These technologies come together through co- operation between the Resident Shield, firewall, and identity protection modules. These modules communicate with each other to provide malware information to each other, increasing the software’s ability to detect and remove threats for which signature-based solutions along have not yet issued detections. Here’s how it works. The firewall has been completely redesigned to make use of application whitelisting, which reduces intrusive firewall alerts by 50%. The new firewall communicates behind the scenes with the behavioral detection technology in the identity protection module to deliver the most accurate detection of new and unknown threats. AVG estimates that this approach delivers 90% fewer false alarms than other products that are attempting to implement this approach. This enhanced protection level is particularly effective against phishing threats through the use of “in-the-cloud” automated testing to detect tell-tale signs that indicate the presence of a new threat. Because the earlier the software can detect a threat, the more effectively it can protect you. Combined Firewall, IDP, and AV Signature detections Each detection technology uses its own techniques for detecting potential threats; combining this information improves overall detection. Here are some of the interactions and benefits: Firewall and IDP Whenever the firewall detects an attempted connection, it consults with IDP. If IDP has determined that this process is trusted it will let the firewall know and thus not require the user to respond to a pop-up question. If IDP has determined that the process is malicious, it automatically instructs the firewall to block all communications, thus reducing the chance of any information leaking from the PC before the threat is quarantined. The process also works in reverse, when the communication is used by IDP to help make a behavioral analysis. Resident Shield and IDP If Resident Shield detects a malicious file being installed, it passes that information to IDP. IDP uses this information to determine whether any related components that might not be detected by Resident Shield are malicious and, if so, remove them. Essentially, being associated with known malware is used as a behavioral characteristic, similar to the concept of guilt by association. In-the-Cloud Check Server and White Lists Basically, whenever a process performs an activity deemed suspicious but with insufficient evidence to confirm it as malware, that process is checked against the in-the-cloud service, which returns back whether this is a trusted, malicious, or unknown process. If the process is trusted or malicious, appropriate actions are taken. If it’s unknown, the process continues to do what 7 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 8. White Paper October, 2009 it was doing, until such time as enough suspicious activity has accumulated to trigger detection. As and when that transpires, the user will be asked to make a decision. If the user approves, the process will be submitted for additional analysis which will in turn mark it as malicious or trusted. That information is then sent to the check service, so that all AVG customers’ PCs that perform checks against this process will be notified immediately. This does several things. It allows for the detection of malware before it gets too far in its activity, as well as preventing any false positives. The trust information is added to the internal configuration, which is then distributed to all the agents as a configuration update, which is distributed periodically to all agents. AVG 9: Choose Your Security For personal use AVG Internet Security Complete protection for everything you do We know the things users like to do on their computers - surfing, shopping, banking, downloading and chatting with their friends - so we developed AVG Internet Security to give them the multiple layers of protection they need to stay safe online. Internet Security is constantly on alert, so they don’t have to be. Includes LinkScanner and Identity Protection. AVG Anti-Virus Essential protection that won’t get in your way AVG Anti-Virus makes sure users’ computers stay free of viruses, spyware, and other malware. It includes AVG’s unique LinkScanner technology to keep them safe from harmful web pages by scanning those pages right as users go to them. AVG Identity Protection Up-to-the-minute protection for online banking and shopping The more time users spend online, the more important it is for them to keep their personal information secure. Anti-virus alone is no longer enough to keep users safe when they’re shopping and banking online; whatever anti-virus they use, they need the added security of AVG Identity Protection. AVG LinkScanner and a less-automated, unsupported version of AVG Anti-Virus are available at no cost for home users unwilling or unable to purchase the commercial products. Licenses are for one year. 8 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 9. White Paper October, 2009 For business use AVG Internet Security Business Edition Complete protection for your business Internet Security Business Edition is faster, smarter security that won’t slow businesses down. AVG’s most advanced protection, Internet Security 9.0 merges ground-breaking online threat prevention techniques with enhanced anti-virus and firewall technologies to deliver proactive protection that’s second to none. Includes new Rescue CD network recovery toolkit. AVG Anti-Virus Business Edition Essential protection for your business With AVG Anti-Virus Business Edition, companies get high-performance, next-generation scanning that doesn’t get in the way of doing business. Plus, they get LinkScanner and enhanced phishing and firewall protection to keep the business safe while employees are online. It’s easy to set up, easy to manage, and includes the new Rescue CD network recovery toolkit. AVG File Server Edition For businesses that already have anti-virus protection on their workstations but need protection for their file server, this is the solution. Includes enhanced anti-virus scanner, LinkScanner web threat protection, and improved phishing detection. AVG Email Server Edition For businesses that already have anti-virus protection on their workstations and file server but need protection for their email server, this is the solution. Includes enhanced anti-virus scanner, LinkScanner web threat protection, centralized spam prevention, and improved phishing detection. AVG Server Edition for Linux/FreeBSD For any organization operating a Linux/FreeBSD Server, particularly for email, this is flexible, scalable protection against infected email and attachments, including on the server itself. AVG supports all leading Linux and FreeBSD e-mail server applications, including PostFix, QMail, Sendmail and Exim. Includes free client software. 9 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 10. White Paper October, 2009 About AVG Technologies AVG is a global security solutions leader protecting more than 80 million consumers and small business computer users in 167 countries from the ever-growing incidence of web threats, viruses, spam, cyber-scams and hackers on the Internet. Headquartered in Amsterdam, AVG has nearly two decades of experience in combating cyber crime and one of the most advanced laboratories for detecting, pre-empting and combating Web-borne threats from around the world. Its free online, downloadable software model allows entry-level users to gain basic anti-virus protection and then to easily and inexpensively upgrade to greater levels of safety and defense in both single and multi-user environments. Nearly 6,000 resellers, partners and distributors team with AVG globally including Amazon.com, CNET, Cisco, Ingram Micro, Play.com, Wal-Mart, and Yahoo!. To find out more about AVG Technologies and its products, please visit www.avg.com. AVG on the Web For up-to-the-minute news on the latest cyberthreats: • Subscribe to AVG Chief Research Officer Roger Thompson’s blog at http://thompson.blog.avg.com/ For general AVG updates: • Join our Facebook community at http://www.facebook.com/avgfree • Follow AVG on Twitter www.twitter.com/officialavgnews • Register at www.avgnews.com 10 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 11. White Paper October, 2009 References 1 MPack: http://en.wikipedia.org/wiki/MPack_(software) 2 Storm worm: http://en.wikipedia.org/wiki/Storm_Worm 3 Conficker: http://en.wikipedia.org/wiki/Conficker 4 US ‘08 identity fraud up in total dollars, victims: http://uk.reuters.com/article/marketsNewsUS/idUKN0646389320090209?pageNumber=1 5 Pump and Dump Schemes: http://www.sec.gov/answers/pumpdump.htm 6 Top Ten Cyber Security Menaces for 2008 http://www.sans.org/2008menaces/ 7  70 Of Top 100 Web Sites Spread Malware http://www.informationweek.com/news/internet/security/showArticle.jhtml?articleID=212901775) 8 Hackers turn Cleveland into malware server http://www.theregister.co.uk/2008/01/08/malicious_website_redirectors/ 9 Short-lived stealthy attacks are the new web threats http://www.avg.com/press-releases-news.ndi-222533 10 Metamorphic code http://en.wikipedia.org/wiki/Metamorphic_code 11 Polymorphic code http://en.wikipedia.org/wiki/Polymorphic_code 12 Malware Quietly Reaching ‘Epidemic’ Levels http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=208803810 11 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.
  • 12. White Paper October, 2009 Corporate offices AVG Technologies CZ, s.r.o. AVG Technologies USA, Inc. AVG Technologies UK, Ltd. Lidická 31, 602 00 Brno 1 Executive Drive, 3rd Floor Glenholm Park, Brunel Drive Czech Republic Chelmsford, MA 01824 Newark, Nottinghamshire, www.avg.cz USA NG24 2EG www.avg.com United Kingdom www.avg.co.uk AVG Technologies GER GmbH AVG Technologies CY Ltd. Bernhard-Wicki-Str. 7 Arch. Makariou III. 80636 München 2-4 Capital Centre Deutschland 1505, Nicosia, Cyprus www.avg.de Fax: +357 224 100 33 www.avg.com 12 © 2009 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.