Kaspersky Securelistpublished Aug 2, 11:00 UTC (Aug 2, 2010)ingested Sep 10, 06:23 UTC@Securelist

Monthly Malware Statistics July 2010

mediumMalwareimportance 35CVE-2010-0806 CVE-2010-0886 CVE-2010-1885 CVE-2010-3867 CVE-2010-0188

Read the original

Tagscve-2010-0806 cve-2010-0886 cve-2010-1885 cve-2010-3867 cve-2010-0188 malware

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2010-0188	Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling CVE-2010-0188 is an unspecified code-injection (CWE-94) flaw in Adobe Reader and Acrobat that allows attackers to cause a denial of service or possibly execute arbitrary code on the victim's machine. It is triggered when an affected application processes a maliciously crafted PDF document, typically delivered as an email attachment or downloaded from a website, so simply viewing the file with vulnerable software is enough to expose the user. A successful attack gives the attacker code execution in the context of the logged-on user, which can be leveraged to install malware or ransomware. Anyone running Adobe Reader or Acrobat is affected; CISA lists the products without published version ranges, so all Adobe deployments should be treated as potentially in scope. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-03-03) with known ransomware use, and EPSS assigns an 88.2% probability of exploitation within 30 days (100th percentile). Do: Apply updates per vendor instructions: install the Adobe security update that fixes CVE-2010-0188 on any legacy Acrobat/Reader deployment and migrate unsupported installations to a currently supported Acrobat/Reader release. Given the known ransomware association, hunt for signs of compromise such as suspicious PDF attachments opened around malware activity, and block or sandbox PDFs at email and web gateways. Verify no critical hosts or automated workflows still depend on outdated Reader/Acrobat components for PDF processing.	—	88%	KEV ransomware	Adobe Reader Adobe Acrobat	masshundreds of millions of installed copies (Reader/Acrobat historically shipped as the default PDF handler on most Windows PCs; exact count of still-vulnerable…	Mar 3, 2022
CVE-2010-0806	Use-After-Free RCE in Microsoft Internet Explorer (CVE-2010-0806) Microsoft Internet Explorer contains a use-after-free (resource management) flaw in which the browser accesses an invalid pointer after an object has been deleted, leaving a dangling pointer. A remote attacker can trigger the flaw by luring a user of a vulnerable Internet Explorer version to attacker-controlled or malicious web content; the dangling-pointer access can be leveraged to execute arbitrary code with the victim user's privileges. Any system still running the affected Internet Explorer builds is exposed; the flaw dates to the 2010 era, when vendor advisories (cumulative update MS10-018, March 2010) addressed it in Internet Explorer 6 and 7, and CISA notes the impacted product may be end-of-life. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-20 (ransomware use unknown), and EPSS assigns an 82.2% probability of exploitation within 30 days; no public proof-of-concept is cataloged. Do: Apply mitigations per Microsoft's vendor instructions within the BOD 22-01 timeframe, which for affected builds means the MS10-018 (March 2010) cumulative Internet Explorer update; because IE 6/7 (and IE generally) are end-of-life/retired, CISA also permits discontinuing use of the product. Inventory the estate for Internet Explorer 6/7 on legacy Windows XP and embedded or unmanaged systems, and migrate any remaining users to a supported, currently patched browser rather than relying on the retired IE client.	—	82%	KEV	Microsoft Internet Explorer Version ranges not enumerated in the KEV data (listed simply as Microsoft Internet Explorer); Microsoft's March 2010 advisory MS10-018 addressed this flaw in In	large~100,000 to 1,000,000 residual legacy installations still running vulnerable IE 6/7 builds (out of the hundreds of millions of IE users when the flaw was…	May 20, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2010-0188

Arbitrary Code Execution in Adobe Reader and Acrobat via Malicious PDF Handling

CVE-2010-0188 is an unspecified code-injection (CWE-94) flaw in Adobe Reader and Acrobat that allows attackers to cause a denial of service or possibly execute arbitrary code on the victim's machine. It is triggered when an affected application processes a maliciously crafted PDF document, typically delivered as an email attachment or downloaded from a website, so simply viewing the file with vulnerable software is enough to expose the user. A successful attack gives the attacker code execution in the context of the logged-on user, which can be leveraged to install malware or ransomware. Anyone running Adobe Reader or Acrobat is affected; CISA lists the products without published version ranges, so all Adobe deployments should be treated as potentially in scope. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2022-03-03) with known ransomware use, and EPSS assigns an 88.2% probability of exploitation within 30 days (100th percentile).

Do: Apply updates per vendor instructions: install the Adobe security update that fixes CVE-2010-0188 on any legacy Acrobat/Reader deployment and migrate unsupported installations to a currently supported Acrobat/Reader release. Given the known ransomware association, hunt for signs of compromise such as suspicious PDF attachments opened around malware activity, and block or sandbox PDFs at email and web gateways. Verify no critical hosts or automated workflows still depend on outdated Reader/Acrobat components for PDF processing.

—

88%

KEV ransomware

Adobe Reader
Adobe Acrobat

masshundreds of millions of installed copies (Reader/Acrobat historically shipped as the default PDF handler on most Windows PCs; exact count of still-vulnerable…

Mar 3, 2022

CVE-2010-0806

Use-After-Free RCE in Microsoft Internet Explorer (CVE-2010-0806)

Microsoft Internet Explorer contains a use-after-free (resource management) flaw in which the browser accesses an invalid pointer after an object has been deleted, leaving a dangling pointer. A remote attacker can trigger the flaw by luring a user of a vulnerable Internet Explorer version to attacker-controlled or malicious web content; the dangling-pointer access can be leveraged to execute arbitrary code with the victim user's privileges. Any system still running the affected Internet Explorer builds is exposed; the flaw dates to the 2010 era, when vendor advisories (cumulative update MS10-018, March 2010) addressed it in Internet Explorer 6 and 7, and CISA notes the impacted product may be end-of-life. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-20 (ransomware use unknown), and EPSS assigns an 82.2% probability of exploitation within 30 days; no public proof-of-concept is cataloged.

Do: Apply mitigations per Microsoft's vendor instructions within the BOD 22-01 timeframe, which for affected builds means the MS10-018 (March 2010) cumulative Internet Explorer update; because IE 6/7 (and IE generally) are end-of-life/retired, CISA also permits discontinuing use of the product. Inventory the estate for Internet Explorer 6/7 on legacy Windows XP and embedded or unmanaged systems, and migrate any remaining users to a supported, currently patched browser rather than relying on the retired IE client.

—

82%

KEV

Microsoft Internet Explorer Version ranges not enumerated in the KEV data (listed simply as Microsoft Internet Explorer); Microsoft's March 2010 advisory MS10-018 addressed this flaw in In

large~100,000 to 1,000,000 residual legacy installations still running vulnerable IE 6/7 builds (out of the hundreds of millions of IE users when the flaw was…

May 20, 2026

Full article1,241 words · extracted from securelist.com · click to collapse

The first Top Twenty list below shows malware, adware and potentially unwanted programs that were detected and neutralized by the on-access scanner when they were accessed for the first time.

Position	Change in position	Name	Number of infected computers
1	0	Net-Worm.Win32.Kido.ir	261718
2	0	Virus.Win32.Sality.aa	174504
3	0	Net-Worm.Win32.Kido.ih	158735
4	0	Net-Worm.Win32.Kido.iq	119114
5	0	Exploit.JS.Agent.bab	108936
6	0	Trojan.JS.Agent.bhr	104420
7	0	Worm.Win32.FlyStudio.cu	80196
8	0	Virus.Win32.Virut.ce	59988
9	-1	Trojan-Downloader.Win32.VB.eql	47798
10	-1	Worm.Win32.Mabezat.b	40859
11	1	Trojan-Dropper.Win32.Flystud.yo	31707
12	new	Worm.Win32.Autoit.xl	31215
13	new	P2P-Worm.Win32.Palevo.aomy	30775
14	-3	P2P-Worm.Win32.Palevo.fuc	26027
15	new	Exploit.JS.CVE-2010-0806.aa	25928
16	new	P2P-Worm.Win32.Palevo.aoom	25300
17	new	Hoax.Win32.ArchSMS.ih	24578
18	2	Trojan.Win32.AutoRun.ke	24185
19	new	Packed.Win32.Katusha.n	23030
20	-5	Trojan-Downloader.Win32.Geral.cnh	22947

The first half of this list remained unchanged from last month, with viruses such as Sality and Virut and the infamous Kido worm all maintaining their positions. The second half, however, threw up a few surprises with six new entries. Let’s look at each of them in turn.

Worm.Win32.Autoit.xl, in twelfth place, is a malicious AutoIt with a varied payload: it can disable Windows Firewall, apply software restriction policies, or download and install other malware. Interestingly, Brazil was responsible for almost a quarter of all infections detected, while approximately another 50% were in Russia and Ukraine.

P2P-Worm.Win32.Palevo.aomy, in thirteenth place, and P2P-Worm.Win32.Palevo.aoom in sixteenth are two new representatives of the P2P-Worm Palevo family already familiar from previous Top Twenty ratings.

Exploit.JS.CVE-2010-0806.aa, a new modification of an exploit for the CVE-2010-0806 vulnerability identified back in March, has entered the Top Twenty in fifteenth place. Cybercriminals are currently making active use of script obfuscation and anti-emulation techniques, which has led to the appearance of new variants of the exploit. Two other entries in this list – Exploit.JS.Agent.bab (fifth place) and Trojan.JS.Agent.bhr (sixth place) – also make use of the same vulnerability. These three programs also made it into the second set of rankings, which examines malware detected on the Internet.

Hoax.Win32.ArchSMS.ih in seventeenth place is yet another newcomer to our rating. It is used as part of a completely new type of scam. The program mainly spreads under the guise of a legitimate piece of freeware. When the application is opened, a window appears stating that the program is archived and that in order to get the password to unpack it, anywhere from one to three SMS messages need to be sent. Each message can cost anything up to 500 roubles (around $16), and in return the user receives either a malicious program, a link to a torrent site or even an error message or an empty archive file. The vast majority of computers where this program has been detected are located in Russian-speaking countries; users in Russia were the most affected, followed by those in Ukraine, Kazakhstan, Belarus, Azerbaijan and Moldova.

The malicious packer Packed.Win32.Katusha.n in nineteenth place is a program used to protect various malicious programs from antivirus software. This detection also covers rogue antivirus solutions which are packed using Katusha.

Malicious programs on the Internet

The second Top Twenty list below shows data generated by the web antivirus component and reflects the online threat landscape. This table includes malware and potentially unwanted programs which are detected on web pages or to victim machines from web pages.

Position	Change in position	Name	Number of attempted downloads
1	1	Exploit.JS.Agent.bab	169086
2	new	Trojan-Downloader.JS.Pegel.bp	123446
3	1	Exploit.Java.CVE-2010-0886.a	65794
4	3	AdWare.Win32.FunWeb.q	58848
5	new	Trojan-Downloader.VBS.Agent.zs	58591
6	-1	Trojan.JS.Agent.bhr	57978
7	return	Exploit.Java.Agent.f	53677
8	new	Trojan-Downloader.Java.Agent.fl	53468
9	2	AdWare.Win32.FunWeb.ds	45362
10	new	Trojan.JS.Agent.bhl	45139
11	3	AdWare.Win32.Shopper.l	37790
12	new	Exploit.HTML.CVE-2010-1885.a	36485
13	new	AdWare.Win32.Boran.z	28852
14	new	Exploit.Win32.IMG-TIF.b	28238
15	new	Exploit.JS.Pdfka.bys	28084
16	new	Trojan.JS.Agent.bmh	27706
17	new	Exploit.JS.CVE-2010-0806.aa	26896
18	new	Exploit.JS.Pdfka.cny	26231
19	new	AdWare.Win32.FunWeb.ci	26014
20	new	Trojan.JS.Redirector.cq	26001

As the table above shows, July saw twelve new entries in this list.

The notorious Pegel, which has remained active over the last three months, claimed second place in July with the .bp modification of the script downloader.

Half of the programs in this list are exploits, eight of which target known vulnerabilities.

Just like last month, Exploit.JS.Agent.bab, which targets the CVE-2010-0806 vulnerability, heads this rating. The same vulnerability is also used by the new entry Exploit.JS.CVE-2010-0806.aa in seventeenth place and Trojan.JS.Agent.bhr in sixth place. Thus, it appears that, contrary to expectations, there has been an upsurge in the targeting of CVE-2010-0806 rather than a decline.

The Java platform presence was bolstered in July by the return to this rating of Exploit.Java.Agent.f in seventh place and a new entry, Trojan-Downloader.Java.Agent.jl in eighth place. These two programs target the CVE-2010-3867 vulnerability and are downloaded by Trojan.JS.Agent.bmh script, which takes sixteenth place.

The new entry Exploit.HTML.CVE-2010-1885.a in third place is a script that exploits the CVE-2010-1885 vulnerability. We blogged about this vulnerability, before it became widely targeted. The file containing the malicious code is an HTML page which includes an iframe with a specially crafted address.

Fragment of Exploit.HTML.CVE-2010-1885.a

When this file is launched, another script (which Kaspersky Lab detects as Trojan-Downloader.JS.Psyme.aoy), is downloaded. This script in turn downloads and launches malware from the Trojan-GameThief.Win32.Magania family that steals passwords to online games. The intermediary script uses an interesting method to mask the malicious link – it is written back to front (see the screenshot below).

Fragment of the Trojan-Downloader.JS.Psyme.aoy script used by Exploit.HTML.CVE-2010-1885.a

We wrote about Exploit.Win32.IMG-TIF.b, which targets the CVE-2010-0188 vulnerability, back in March, but it has only started to actively spread very recently. It’s interesting to note that the virus writers made virtually no use of this vulnerability for two or three months after it was officially acknowledged.

Exploit.JS.Pdfka.bys, in fifteenth place, and Exploit.JS.Pdfka.cny in eighteenth are both scripts that exploit various vulnerabilities in Adobe products.

Five of the Top Twenty are adware programs: three variants of AdWare.Win32.FunWeb (in fourth, ninth and nineteenth places), AdWare.Win32.Shopper.l (eleventh place) and AdWare.Win32.Boran.z (thirteenth place). Boran.z is a new entry that was first detected in October 2009. It is a BHO module that comes together with a driver designed to protect it.

Trojan.JS.Agent.bhl is another program that displays irritating adverts, and yet another new entry. This script opens pop-up windows and uses a range of technologies to bypass pop-up blockers. The screenshot below shows displaying comments and the code the module uses to bypass Norton Internet Security.

The rest of the programs in this list are all designed to spread other malicious programs.

Conclusion

The figures for July once again reflect the trend for exploiting vulnerabilities in order to spread malware. Programs making use of vulnerabilities have even made it into the list of malicious programs detected on users’ computers.

The script downloader Pegel and the vulnerabilities it targets (CVE-2010-0806, CVE-2010-3867 etc.) are still very widespread despite the efforts of the antivirus industry, and Adobe and Microsoft who have been quick to release patches. A large number of programs that exploited the recently publicized vulnerabilities CVE-2010-0188 and CVE-2010-1885 were detected in July.It’s also worth mentioning the rapid spread of Stuxnet, a rootkit driver that uses genuine digital signatures. The worm is still making use of a vulnerability in LNK files (Microsoft Windows shortcut) that has yet to be addressed. The vulnerability allows a random dll to be run without user interaction if a shortcut icon for the program is displayed.

The one piece of good news is that Gumblar has stopped spreading. But for how long?

Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/monthly-malware-statistics-july-2010/36313/