Virus Top Twenty for April 2004

April 2004 turned out to be a quiet month – relatively speaking. Relative, that is to March 2004, the worst month in computer virus history to date. In April, NetSky won in the new variants sweepstakes, versus Bagle in March. 6 new Netskys pushed Bagle.i down to a mere 13th place. In fact, it’s fair to say that Netsky seems to have won the virus war conducted so fiercely by the Bagle and Netsky authors in February and March.

However, he who laughs last, laughs best: the arrest of the 18-year old German coder claiming to be the authour of the Netsky worms may mean that Bagle still has a chance to have the last laugh in the virus wars. Not an optimistic scenario for the computing community, but certainly a possibility. In the meantime, not only did NetSky.b managed to retain first place in April, as well as March, but NetSky variants also took second and third place.

The Mydoom worms are continuing to slip in the ratings, both falling 3-4 places. We may see one or both disappear in the May ratings. Swen, one of last year’s favourites, is surprisingly enough still in the top 10. Sadly, this confirms the success of the social engineering implemented by the author – Swen arrives disguised as a ‘hot update’ from Microsoft and people are still falling for this trick.

It is interesting to note that Lentin.v, first detected in December 2003 is creeping up in the ratings, moving from 17th to 15th place. Lentin.v and the newcomer LovGate.w (in 14th place) demonstrate that classic propagation methods do still work.

Klez.h is simply amazing! The worm was detected exactly two years ago and has been in the top twenty ever since. We can only guess at how many computers have been infected over these two years, but the figure must by now be in the millions.

And finally, we have Dumaru and Mimail. Only the very first variants of both worms remain in the top twenty. NetSky has scored again, since NetSky removes Mimail variants and other viruses from infected systems.

This month other malicious programs made up a significant proportion of overall traffic. On the other hand, we registered only a little over 500 different types of malware, i.e. less than half the number detected in March.

Summary

New entries: 6 Netsky variants and LovGate.w

Moved up: Netsky.q and Lentin.v

Moved down: Mydoom.a, Netsky.d, Mydoom.e, Swen, Mydoom.g, Netsky.c, Bagle.i, Klez.h and Mimail.a

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.