November top 20 malware and viruses

Although the malicious programs leading November’s 2007 Email Top Twenty have changed, the data once again highlights the absence of any serious epidemics in mail traffic. There’s been a sudden change to the leading three malicious programs, caused by Scano.gen’s rocketing twelve places up the table together with the Mytob.t (up 12 places) and NetSky.x (up 8 places) worms. This change simply reflects the insignificant number of malicious programs which are actually spreading via mail traffic.

The volatility of the ratings is currently so marked that any malicious program which is in the ratings this month could either take first place next month, or disappear off the bottom end of the table.

There’s only one program in this month’s Top Twenty which barely changed its position, and that’s Trojan-Spy.HTML. Fraud.ay, a phishing attack. In November this program took fourth place, whereas last month it was in second place. The Trojan program targets users of Yandex.Dengi (the Yandex e-payment system). It’s not a particularly original piece of malicious code, and both antivirus programs and spam filters can detect it easily. Meanwhile, the fake sites which are part of the attack are detected by the anti-phishing modules in popular browsers.

In November, the notorious exploit which used vulnerabilities in Adobe products disappeared from the ratings. Among the leaders of the October Top Twenty was an exploit targeting a vulnerability in Adobe products. However, this month’s data shows that modifications of this program, (a malicious PDF file which acts as a downloader) have disappeared just as quickly as they appeared.

However, another exploit, IMG-WMF.y, set a record this month, on the eve of its second anniversary. This program gained the most positions, rising thirteen places to sixth place overall. This had the side effect of causing the Womble.a, a worm linked with the exploit, to return to the Top Twenty.

There were a relatively large number of returns to the rankings in November: four at once, including Warezov.pk, which ended up in seventh place. Add the five new entries (the most ‘successful’ being Warezov.um, which entered the rankings in ninth place) and the rise of LovGate.w by nine places after its re-entry in October, and the November Top Twenty starts to look rather unusual. On one hand, all the old familiar worm families are represented: NetSky, Mydoom, Bagle, Feebs, Nyxem and Scano. On the other hand, the presence of new Trojan-Spy and Trojan-Downloader programs makes this month’s statistics unusual. It’s likely that in the coming months the situation will continue to evolve along similar lines, with the upper part of the table being occupied by email worms, as is traditional, and the lower positions being taken by Trojan programs and exploits.