NetSky versions dominate October viruses

By Matt Whipp

Posted on 1 Nov 2004 at 11:33

October has closed with some familiar viruses having been most prolific through the month.

Sophos' figures puts NetSky P as having caused the most infections for its customers, with Zafi-B in the second spot, taking 35.2 per cent and 28 per cent respectively.

The remainder of the chart is peppered with NetSky, Bagle and MyDoom variants, a legacy of the virus 'wars' earlier this year as they battled for control of computers to use as 'zombies'.

'With only one new entry, at the bottom of this month's chart, the dominance of Netsky-P and Zafi-B seems unshakable,' said Carole Theriault, security consultant at Sophos. 'These viruses are so prevalent and well established that it is very difficult for newer viruses to compete. Thousands of copies are circulating all over the world - it may be that unprotected PCs in areas where computer security is not a top priority are responsible for keeping the menace alive.'

Kaspersky too put NetSky variants at the top of its chart in positions one to three, with the remainder looking similar to Sophos' roll call.

However, one interesting item in the lower echelons was the return of Rbot.gen. This
backdoor bot is controlled via IRC channels and normally spreads by exploiting a number of vulnerabilities in Windows (RPC DCOM, LSASS among others). However, with the release of Service Pack 2, this month, the virus writers have decided that updated Windows XP machines pose too many barriers: so they chose to send Rbot via email instead.

Sophos' top ten are:

1. W32/Netsky-P 35.2 per cent
2. W32/Zafi-B 28.0 per cent
3. W32/Netsky-D 7.0 per cent
4. W32/Netsky-Z 5.8 per cent
5. W32/Bagle-AA 4.4 per cent
6. W32/Netsky-B 3.9 per cent
7. W32/Netsky-Q 2.6 per cent
8. W32/MyDoom-O 2.2 per cent
9. W32/Netsky-C 1.9 per cent
10. W32/Bagle-Zip 1.0 per cent

Kaspersky's top 20 are:

1 I-Worm.NetSky.q 15.95
2 I-Worm.NetSky.aa 14.45
3 I-Worm.NetSky.b 10.52
4 I-Worm.Bagle.as 7.43
5 I-Worm.Bagle.z 6.59
6 I-Worm.Mydoom.m 5.90
7 I-Worm.Bagle.at 4.01
8 I-Worm.Zafi.b 3.03
9 I-Worm.NetSky.t 2.90
10 I-Worm.NetSky.d 2.83
11 I-Worm.NetSky.y 2.31
12 I-Worm.LovGate.w 2.30
13 I-Worm.Mydoom.l 1.82
14 I-Worm.Mydoom.ab 1.75
15 I-Worm.NetSky.r 1.39
16 I-Worm.Bagle.gen 1.37
17 I-Worm.MyDoom.r 1.31
18 I-Worm.NetSky.c 0.95
19 I-Worm.Bagle.ah 0.87
20 Backdoor.Win32.Rbot.gen 0.68