Online Scanner Top Twenty for August 2007

It seemed as though we had almost completely got rid of the Rays and Brontok worms. In June, Rays did not make the Top Twenty, but it was back again hanging onto twentieth place in July. Brontok’s position dropped over the same period by seven places each month, and the worm didn’t even make the Top Twenty in July. The two both made a comeback in August, however. Brontok returned with a bang in fourth place, and Rays climbed ten positions, making it into the Top Ten.

In general, the changes in online statistics are much less than significant than they have been over the past few months. Only 4 new malicious and potentially unwanted programs have emerged. The percentages of all of the programs that made the top twenty are extremely small – Packed.Win32.PolyCrypt.b, the leader in August, garnered just 2%. This is striking compared to Dialer.cj’s chart-topping 9% in July (which nevertheless did not prevent it from disappearing without a trace in August).

Malicious programs such as Bancos.aam and Trojan-Downloader.Win32.Small.ddp also managed to make a comeback in August. The former covers several hundred spyware programs which target both user bank accounts and the clients used to access certain stock exchange trading systems. What distinguishes Bancos.aam is its special ‘interface’: the Trojan can be used as a botnet component, making it possible for a malicious user to send individual instructions to each infected machine about which payment system accounts to target. Small.ddp is also designed to install several malicious botnet components on infected systems.

Overall, there are more Trojan Spies in the Top Twenty this month than there were in June or July. Newcomers include Trojan-Spy.Win32. Ardamax.e, a keylogger, and Perflogger.ca, which has similar functionality but is a legitimate program. In addition to Perflogger.ca, Perflogger.ad, another potentially unwanted program also made the Top Twenty this month (18th place).

The leader in June, a piece of adware called Virtumonde.jp, was able to stop its decline after a ten-position plummet in July, and placed 11th in August. Expect to see more of this program, since its main carrier, Trojan-Downloader.Win32.LoadAdv.gen, has once again been ranked in the top three most common malicious programs, up from sixth place. This means more new variants of Virtumonde can be expected in the future.