Virus Top Twenty for December 2005

Position	Change in position	Name	Percentage
1.	+2	Email-Worm.Win32.Zafi.d	29.17
2.	-1	Net-Worm.Win32.Mytob.c	17.30
3.	+2	Email-Worm.Win32.LovGate.w	6.07
4.	+9	Email-Worm.Win32.Sober.y	4.92
5.	+13	Email-Worm.Win32.Zafi.b	3.73
6.	+1	Email-Worm.Win32.NetSky.b	3.58
7.	-1	Email-Worm.Win32.NetSky.q	2.75
8.	0	Net-Worm.Win32.Mytob.t	2.29
9.	+1	Net-Worm.Win32.Mytob.u	2.28
10.	+2	Net-Worm.Win32.Mytob.q	1.79
11.	-2	Net-Worm.Win32.Mytob.bk	1.54
12.	-1	Net-Worm.Win32.Mytob.h	1.45
13.	New	Trojan-Spy.HTML.Bayfraud.hn	1.36
14.	Return	Email-Worm.Win32.LovGate.ae	1.35
15.	+4	Email-Worm.Win32.NetSky.y	1.00
16.	Return	Net-Worm.Win32.Mytob.w	0.96
17.	Return	Net-Worm.Win32.Mytob.a	0.96
18.	-1	Email-Worm.Win32.Bagle.dx	0.83
19.	-4	Net-Worm.Win32.Mytob.y	0.81
20.	Return	Net-Worm.Win32.Mytob.x	0.79
Other malicious programs			15.07

December 2005 was a month of great activity, in sharp contrast to the stability shown by the leaders of the Virus Top Twenty in November. There were great changes in the top six positions, with yet another set of worms topping the ratings. Against all expectations, the leader was not a worm from the Mytob or Doombot families, but Zafi.d, which has been in circulation for over a year and a half. Zafi.d made up almost 30% of all malicious programs intercepted this month, a very impressive figure.

The leader for the past few months, Mytob.c, dropped into second place, although the number of samples detected remained almost at its previous level. And this is where the situation becomes really interesting.

The Doombot family, which entered the Top Twenty with a bang a couple of months ago, and which has been posing serious competition to Mytob, has unexpectedly disappeared. And it’s not only Doombot.g and .d (which were in 16th and 20th place respectively) which have vanished, but also Doombot.b, which took 2nd place in November. If new malicious programs had appeared in the Top Twenty this month, it would have been these more active programs which squeezed Doombot out of the rankings, an entirely natural process. However, this is not what happened in December.

The further down the table we go, the more interesting it becomes. LovGate.w, a veteran of our virus ratings, reached third place. This Asian worm has displayed such stability and stamina for several years that we are no longer surprised by its appearance in our Top Twenty. We’ve seen new leaders such as Mydoom, Bagle, Sober and NetSky rise and fall, and they are now melting into the shadows, in contrast to LovGate.w, which was and remains among the most widespread worms. In addition to this, another LovGate, version .ae, has returned to the Top Twenty, making it into 14th place.

In November, Sober.y was the malicious program which received the most publicity. Our statistics show that this worm occupied 13th place in November. This was due to the fact that in spite of causing an epidemic, the worm sent itself to email addresses in Western Europe, leaving Russia largely untouched. However, the epidemic was so large that at some stage it was bound to reach Russia, and in December this came to pass. Sober.y rose by 9 places to reach 4th place. Sometime around the middle of December, it stopped sending itself out and retreated into hibernation. However, some data shows that it will come out of hibernation on 5th January, during the night, when it will attempt to download a new version of itself to computers which it had previously infected. All users should be extremely careful and highly suspicious of all messages with attachments, particularly if they appear to originate from a government body such as, for instance, the FBI. The author of Sober may also use the new version of the worm to mass mail millions of emails containing right wing/ nazi propaganda.

Zafi.b has been one of the most widespread email worms of the past two years. It has led our ratings several times, but over the past few months, it has decreased significantly in number. In November this worm was in 18th place, and logically should have dropped out of the Top Twenty this month. However, the surge shown by its relative, Zafi.d, inevitably had an effect on Zafi.b’s figures; the worm rose 13 places, which is one of the most impressive results of 2005, and finished in 5th place.

To sum up, the top five includes 2 worms from the Zafi family, one Mytob, one Sober and one LovGate. Apart from Mytob.c, there’s no sign of Mytob’s previous domination among the leaders. In spite of the fact that 10 Mytob variants remain in the Top Twenty, it seems likely that soon they will be edged out by the new worms which will start to appear in 2006.

13th place in our Top Twenty is highly significant, as it’s occupied not by a worm, not by a virus, but by an email! Trojan-Spy.HTML.Bayfraud.hn is one of the many hundreds of phishing emails which were sent to eBay users in December 2005. A figure of 1.36% of all virus traffic is very respectable, and shows that phishing is not going to disappear from the cyber threat horizon, but is continuing to evolve, and will remain a major security problem in 2006.

Other malicious programs made up 15.07% of all those intercepted in mail traffic, indicating that a relatively large number of worms and Trojans from other families are still in circulation.

Summary: