Virus Top Twenty for February 2004

Kaspersky Labs presents the Virus Top Twenty for February 2004

History was made in February 2004, which turned out to be the most active month in computer virology for the past several years. There has never been such a large number of email worms active at the same time.
First we had January’s leader, Mydoom.a which stayed in first place. Even though the worm stopped propagating as of February 12, Mydoom.a retained its leading position due to the huge number of copies mailed before February 12 as well as the large number of infected machines with incorrect dates.
Next we have some new entrants that will undoubtedly play a key role in March. There are six newcomers, which is very unusual, and they belong to four different categories.
The most important newcomer is I-Worm.Moodown.b (NetSky.b) which the creator coded to disinfect machines infected by Mydoom.a, but also to interfere with antivirus programs.
The second significant newcomer is Mydoom.e. Unlike Mydoom.a, this version deletes random MS Office documents. It is highly likely that this version was based on the original Mydoom.
Our old ‘friend’ Mimail is now polymorphic and spreads as a polymorphic dropper. Mimail.q was the first version with this new feature and it immediately climbed to 10th position in the top twenty.
The creator of Moodown (NetSky) seems to have been encouraged by the havoc wreaked by second version; he or she made some minor changes and released a third version. Moodown.c is only 15th in the ratings, but should aggravate users for quite some time to come.
One of January’s leaders, Bagle.a has left the ratings, but we do have Bagle.b to take its place. However, at the very tail end of February we also saw a slew of new Bagles: versions c through f. These versions did not make the top twenty, but we can be sure that they will cause trouble in March.
The last newcomer in the top twenty is yet another version of Mydoom – Mydoom.b. It appeared at the end of January and needed all of February to make its presence felt.
The other stars of the monthly ratings are old friends who move up and down the scale without leaving the top twenty. Swen and Sober.c refuse to yield to newer worms and continue to hold their positions.
Win32.FunLove.4070 has returned to the top twenty. The return of this file virus is easy to explain: it mostly arrives with email worms having infected the carrier files first.

Summary

• New viruses: Mydoom.b, Mydoom.e, Bagle.b, Moodown.b, Netsky.c and Mimail.q.
• Moved up: Sobig.f, Mimail.j, Dumaru.j and Dumaru.a.
• Moved down: Swen, Sober.c, Mimail.a, Klez.h, Tanatos.b, Lentin.m and .Mimail.c
• Returned: Win32.FunLove.4070.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.