Virus Top Twenty for July 2004

4no changeI-Worm.Netsky.q2.94%

Antivirus professionals have long known that viruses come in waves; June, July and December are usually down times. Maybe it’s because virus writers are people too – they too take vacations and if they go away, they may even forget to take their computers along.

July 2004 confirms this theory, with very few changes from the June ratings. The top five viruses are identical to the top five in June; only the percentages have changed. Zafi.b is the absolute leader this summer with 57%, this figure making it the second most frequent virus of the year. Only Mydoom.a is ahead of Zafi.b with a recording-breaking almost 80%.

Zafi.b is a paradox – an average worm, with nothing interesting in the code or the social engineering methods used to trick users into opening infected attachments. And yet it has beat many more technologically advanced viruses. Certainly changing the language of the incoming email in accordance with the recipient’s country is a novel idea. However this is Zafi.b’s only interesting feature. Perhaps Zafi’s dominance can be explained by the fact that users have relaxed now that summer is in full swing and are being less cautious about opening attachments.

There are very few new entries to the Top Twenty: Bagle.gen leads the way. Bagle.gen is a catchall for all Bagle variants that propagate as password protected attachments. There are also several new versions of Bagle which were most likely released by copycat coders after Bagle.aa appeared complete with the Bagle source code inside. Bagle.ai and Bagle.ah make a modest first appearance, but we are likely to see more remakes of this particular malicious oldie.

14th place is occupied by Backdoor.Rbot.gen, a catchall for 30 or so similar backdoors. This is worth remarking on as these programs are not the email worms which everyone has become so used to over the past few months. These backdoors use various Windows vulnerabilities to give the sender full control over infected machines. Rbot variants accept commands to send copies of themselves via email, which probably accounts for the appearance of this backdoor in the virus top twenty.

And finally, like the Phoenix rising from the ashes, Sobig.f has not only returned, but even jumped immediately to number 13. This program last made an appearance in the Top Twenty in February this year.

Other malware continued to make up a significant amount of traffic for the third month in a row. In total, over 1000 different viruses were detected in July, over 3 times more than in June.

Summary

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.