JPEG virus surfaces; Klez endures

By Edward Hurley, News Writer 02 Jul 2002 | SearchSecurity

Digg This!     StumbleUpon     Del.icio.us

Klez continued to plague e-mail recipients in June, a month when the first piece of malicious code to focus on a digital image was introduced.

The antivirus world got a glimpse of the Perrun worm, which can potentially run malicious code from a JPEG file. The author released it as a proof-of-concept worm to antivirus companies. It's not in the wild.

Yet there were plenty of viruses in the wild to worry about such as W32/Yaha.E, which can arrive in an e-mail masquerading as a screensaver. There was also Worm.Frethem.D, which arrived purporting to be a decrypted password. Long-time pests such as Badtrans, Nimda and Sircam are still making the rounds.

One interesting fact is most, if not all, of the top viruses in June were Windows 32 viruses, not Word macro or script viruses, said Chris Wraight, technology consultant at Sophos Americas. "Worms and viruses that spread using networking functions or e-mail clients currently dominate inquiries to our customer support."

Below are the monthly virus numbers from different antivirus vendors:

Symantec's top five virus threats
W32.Klez.H@mm
W32.Badtrans.B@mm
W32.Nimda.A@mm
W32.Sircam.Worm@mm
W95.Hybris.Gen

Sophos' top list of viruses
1. W32/Klez-H 29.4%
2. W32/Badtrans-B 23.5%
3. W32/ElKern-C 6.3%
4. W32/Magistr-B 4.0%
5. W32/MyParty-A 3.7%
6. W32/Klez-E 3.0%
7. W32/Sircam-A 2.8%
8. W32/Magistr-A 2.0%
9. W32/FBound-C 1.8%
10. W32/Nimda-A 1.1%
Others: 22.4%

MessageLabs top ten malicious code for the last four weeks
1.W32/Klez.H-mm
2.W32/Klez.E-mm
3.W32/Yaha.E-mm
4.W32/SirCam.A-mm
5.VBS/VBSWG.AQ-mm
6.W32/Magistr.B-mm
7.W32/Hybris.B-mm
8.W32/Magistr.A-mm
9.W32/Frethem.F-mm
10.W32/Yaha.C-mm

Trend Micro's top list of viruses for the last 30 days
1. Worm Klez.H
2. PE Funlove.4099
3. PE Elkern.D
4. PE Nimda.E
5. PE Nimda.A
6. PE Nimda.A-O
7. Worm Sircam.A
8. JS Noclose.E
9. PE Magistr.B
10. Worm Klez.E

Command Central's most prevalent viruses list
1. Worm/Klez.E (includes G variant) 60.2%
2. W32/Elkern.C 24.5%
3. Worm/W32.Sircam 3.9%
4. W32/Yaha.E 2.6%
5. W32/Nimda 2.3%
6. W32/Magistr.B 1.9%
7. Worm/Frethem.D 1.6%
8. Worm/Badtrans.B 0.7%
9. W95/CIH 0.4%
10. W95/Hybris 0.4%
11. W32/Magistr.A 0.2%
12. Worm/Shakira 0.1%
Others: 1.2%

Digg This!     StumbleUpon     Del.icio.us

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary