Virus Top Twenty for September 2007

Position	Change in position	Name	Proactive Detection Flag	Percentage
1.	0	Email-Worm.Win32.NetSky.q	Trojan.generic	25.22
2.	+1	Email-Worm.Win32.NetSky.aa	Trojan.generic	10.83
3.	+3	Email-Worm.Win32.Mydoom.l	Trojan.generic	10.04
4.	-2	Email-Worm.Win32.Bagle.gt	Trojan.generic	7.62
5.	Return	Email-Worm.Win32.Nyxem.e	Trojan.generic	6.03
6.	-2	Net-Worm.Win32.Mytob.c	Trojan.generic	5.18
7.	-2	Worm.Win32.Feebs.gen	Hidden Data Sending	4,69
8.	-1	Email-Worm.Win32.NetSky.t	Trojan.generic	3.03
9.	New	Trojan-Spy.HTML.Paylap.bg	[HTML]	2.62
10.	0	Email-Worm.Win32.NetSky.b	Trojan.generic	2.62
11.	0	Email-Worm.Win32.NetSky.x	Trojan.generic	2.35
12.	0	Email-Worm.Win32.Scano.gen	Trojan.generic	1.72
13.	-5	Exploit.Win32.IMG-WMF.y	[WMF]	1.58
14.	-5	Net-Worm.Win32.Mytob.t	Worm.P2P.generic	1.38
15.	+3	Net-Worm.Win32.Mytob.dam	[Damaged]	1.35
16.	0	Email-Worm.Win32.Womble.a	Trojan.generic	1.06
17.	Return	Email-Worm.Win32.NetSky.d	Trojan.generic	1.03
18.	-5	Net-Worm.Win32.Mytob.u	Worm.P2P.generic	0.97
19.	Return	Email-Worm.Win32.Mydoom.e	Trojan.generic	0.93
20.	Return	Email-Worm.Win32.NetSky.y	Trojan.generic	0.83
Other malicious Programs				8.92

Our forecasts for September turned out not to be spot on. Trojan-Downloader.Win32.Agent.brk, which was spreading actively in August, didn’t extend the botnet that it builds, and as a result, there’s not a single Warezov variant in September’s Top Twenty.

However, the authors of another email worm, Zhelatin (aka the Storm worm) stepped up their activity. Throughout August security companies provided regular reports and estimates on the scale of the botnet created by the worm. Some estimates were as high as 2 million infected computers around the world – indicating that a new epidemic was on the horizon. However, September was remarkably calm from this point of view. Either the numbers were erroneous, or the authors of Zhelatin have decided to take a break until law enforcement agencies around the world direct their attention elsewhere.

Netsky.q is once again in first place. This worm has finally achieved notoriety as the most widespread malicious program in the history of the Internet. Mydoom.a remains the leader in terms of numbers (this worm infected 8 out of every ten emails at the peak of the epidemic in January 2004) but Netsky is way out in front overall.

Keeping the leader company in the top five positions are other longtime residents of the rankings: Netsky.aa, Mydoom.l, Bagle.gt, and Nyxem.e, in a surprising comeback. This worm was first detected in January 2006, with the peak of the epidemic being in summer/ autumn of the same year. We’ve seen this worm disappear from the rankings many times, but somehow it always manages to stage a comeback and climb to near the top of the table.

Exploit.Win32.IMG.WMF.y has become slightly less common. Having risen seven places up the table in August, in September it fell five places. However, its main partner, the Womble worm, remains unshakeable in sixteenth place. It’s almost inevitable that in October we will again see these two in the mail traffic rankings.

Feebs.gen and Scano.gen, both script worms, managed to effectively retain their positions: Feebs fell by a mere two places, and Scano managed to hang onto twelfth place (having risen five positions in August), indicating that these programs will continue to be active in the future.

The only newcomer to the rankings is a phishing attack on PayPal customers: Trojan-Spy.HTML.Paylap.bg. The first examples of this phishing email were detected back in January 2005. And after two and a half years, some unknown malicious users have decided to breathe new life into this old approach, but not terribly successfully. Kaspersky® Anti-Virus detected this mass-mailing without the need for new signatures, simply using the old records from 2005.

Other malicious programs made up 8.92% of all malicious code in mail traffic, indicating that there is still a relatively large number of other worm and Trojan families in circulation.

Summary

• New: Trojan-Spy.HTML.Paylap.bg
• Went up: Email-Worm.Win32.NetSky.aa, Net-Worm.Win32.Mydoom.l, Net-Worm.Win32.Mytob.dam
• Went down: Email-Worm.Win32.Bagle.gt, Net-Worm.Win32.Mytob.c, Worm.Win32.Feebs.gen, Email-Worm.Win32.NetSky.t, Exploit.Win32.IMG-WMF.y, Email-Worm.Win32.Mytob.t, Email-Worm.Win32.Mytob.u
• Re-entry: Email-Worm.Win32.Nyxem.e, Email-Worm.Win32.NetSky.d, Email-Worm.Win32.Mydoom.e, Email-Worm.Win32.NetSky.y