Sophos: Top 10 Viruses and Hoaxes in March 2003

Klez still top virus, JDBGMGR knocked off perch by WTC Survivor hoax

This is the latest in a series of monthly charts counting down the ten most frequently occurring viruses and hoaxes as compiled by Sophos, a global leader in anti-virus protection for businesses.

For March 2003, the virus chart is as follows, with the most frequently occurring virus at number one:

1. W32/Klez-H (Klez variant) 15.3% 14th MONTH WITH KLEZ IN TOP TEN
2. W32/Sobig-A (Sobig worm) 5.2%
3. W32/Gibe-D (Gibe variant) 4.4% NEW ENTRY
4. W32/Avril-B (Avril variant) 3.2%
5. W32/Yaha-E (Yaha variant) 3.0%
6. W32/Avril-A (Avril worm) 2.6%
7. W32/Yaha-K (Yaha variant) 2.4%
8. W32/Bugbear-A (Bugbear worm) 2.2%
9=. JS/NoClose (NoClose worm) 2.0% NEW ENTRY
9=. W32/Lovgate-B (Lovgate variant) 2.0%

Others 57.7%

“Klez continues to hang around like a bad smell – those hit by it couldn’t have updated their anti-virus protection in more than a year. Now that it’s possible to receive fully automated updates, there’s really no excuse. And although it’s easy to protect against Klez, it’s a seriously nasty virus to recover from,” said Graham Cluley, senior technology consultant, Sophos Anti-Virus. “Indicating the growing popularity of file sharing, this month’s highest new entry is Gibe, a worm which spreads via the KaZaA network. Businesses need to have a long hard think about whether these applications have a valid place on their networks.”

Sophos detected 883 new viruses, worms and Trojan horses in March. The total number it now protects against is 80,962.

The top ten hoaxes reported to Sophos during March 2003 are as follows:

1. WTC Survivor 22.4% NEW NUMBER ONE
2. JDBGMGR 15.5%
3. 030303 7.5% NEW ENTRY
4. Hotmail hoax 5.9%
5. Meninas da Playboy 5.3%
6. Bonsai kitten 4.9%
7=.Budweiser frogs screensaver 4.8%
7=.A virtual card for you 4.8%
9. Bill Gates fortune 2.9%
10. BUDDYLYST.ZIP 2.6%

Others 23.4%

“The WTC Survivor hoax – which falsely warns of a September 11th themed virus – has taken over the number slot for the first time in a year. People receiving this hoax should ignore its advice and not email the warning to everyone they know. Much like real viruses, hoaxes clog mail servers and cause much unnecessary confusion,” continued Cluley.

Sophos has made available a free, constantly updated information feed for intranets and websites which means users can always find out about the latest viruses and hoaxes: www.sophos.com/virusinfo/infofeed/ Graphics of the above Top Ten virus chart are available at www.sophos.com/pressoffice/imgallery/topten For more information about safe computing, including anti-hoax policies, please visit: www.sophos.com/safecomputing//A>