CoreFloo-C enters October chart of virus reports

By Alun Williams

Posted on 3 Nov 2003 at 11:33

October has been a busy month for virus reports, and Sophos has produced its monthly chart of the most frequently reported threats.

A new variant of Mimail may be doing the rounds, but its ancestor - Mimail-A - remains one of the most prevalent viruses reported to Sophos.

The top three - of Gibe-F, Dumaru-A and Mimail-A - actually remain unchanged, and it is a fairly static chart.

While Klez-H clocks up its 21st month in the chart, notching 4.4 per cent of reports, there is a new entry with CoreFloo-C and the Rox worm wriggles back into the chart with 1.0 per cent of reports.

CoreFloo-C is an Internet Relay Chat (IRC)-focused Trojan, and is part of an increasing trend for Internet Messaging-related threats. According to Carole Theriault, security consultant at Sophos, it is the first time this year that a Trojan has made it into the top ten, which is dominated by Windows 32 viruses.

Commenting on the latest monthly table, Theriault highlighted the viruses that pose as Microsoft alerts. She said: 'With over 36 per cent of reports, Gibe-F and Dumaru-A - both of which pose as security patches from Microsoft support - are threatening to destroy computer users' trust in Microsoft.'

As always, we should point out that Microsoft do not release security updates in the form of email attachments. This should always be borne in mind. There will only be a link back to the Windows Update site.

Here is the chart in full:

1. W32/Gibe-F (Gibe variant) 22.7 per cent
2. W32/Dumaru-A (Dumaru virus) 13.6 per cent
3. W32/Mimail-A (Mimail worm) 12.4 per cent
4. W32/Sobig-F (Sobig variant) 9.0 per cent
5. W32/Klez-H (Klez variant) 4.4 per cent
6. W32/Nachi-A (Nachi worm) 4.3 per cent
7. W32/Blaster-A (Blaster worm) 2.4 per cent
8. Troj/CoreFloo-C (CoreFloo Trojan) 2.1 per cent
9. W32/Bugbear-B (Bugbear variant) 1.6 per cent
10. W32/Rox-A (Rox worm) 1.0 per cent

Others 26.5 per cent