New worms top January virus charts

By Matt Whipp

Posted on 3 Feb 2003 at 12:45

The Avril and Yaha worms oust Klez and Bugbear to steal the prevalence crown for January.

The Avril Lavigne email worm was first discovered early in the month, but quickly tunnelled up the charts to the top two spots, with variants A and B accounting for 29.2 per cent of reported incidents.

Klez still held on at 3 but Bugbear is slowly sliding down the chart at 6.

Yaha worms made a resurgence, with one new variant written by a virus writer that scanned a victim's system for infections by a Yaha worm authored by a rival writer and then removed it and replaced it with the new variant.

Even so, while the new contenders are expected to decline - Klez simply refuses to go away. Carole Theriault, antivirus consultant at Sophos said: 'We saw Klez infections begin to drop off in November and December, but there was a resurgence in January. That may have been partially brought about by less businesses using computers during the holiday season - we often see a drop in virus reports in December for instance.

'Bugbear, on the other hand, has been steadily declining since its first huge appearance at the very end of September.

'We would not consider the Avril worm's breakout to be as significant as the initial Klez or Bugbear spread - but it is still a widespread virus.'

She warned that while home and small business users may have email scanning systems that detect email-aware worms, such as Bugbear, they are still prone to infection from Internet worms that don't use email.

For example, variants of the Opaserve worm on average occupied four positions of the top ten charts for October, November and December of last year.

'There is a real danger that computer users may concentrate too much of their attention on the email-aware viruses, whereas there are significant viruses that can infect you
over the internet without using email. Of course, traditional desktop anti-virus software which is kept up to date can protect against these.' she said.

Perhaps one of the more destructive viruses for the month, however, was the Slammer worm that is reported to be the fastest spreading bug ever and to have caused around $1bn in damages - crashing everything from email services to ATM transactions.

Graham Cluley, senior technology consultant, Sophos Anti-Virus said: 'The arrival of the Slammer worm - exploiting a six month old vulnerability... reinforced the need for everyone to ensure their patches are kept up to date.'

As ever, hoaxes are still causing problems. Said Cluley: 'The JDBGMGR hoax is still the most problematic of the email hoaxes. We all have a part to play in slowing down the spread of this hoax. If you receive this email, simply delete it.'

A more concrete event in January was the sentencing of Welsh virus author Simon Vallor, responsible for at least three viruses. He has been jailed for 2 years under the Computer Misuse Act.

Sophos detected 521 new viruses for January, and offers antivirus protection for nearly 80,000.