| |||
|
|
||
|
|||
| |
|
Home > Security News > Klez spread slowing to a trickle |
| |
|
|
|
|
| Security News: |
|
||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|
||||||||||||||||||||||||||||||
Klez was still the most active malicious code in August, but its reign seems to be slowing as it's not racking up the numbers it did earlier in the year. For example, U.K.-based antivirus vendor Sophos estimated Klez (G and H variants) accounted for 77.8% of support calls in April. In August, Klez only accounted for 17% but that was enough to take the top spot for the month.
Discovered early this year, variants of Klez have dominated the virus landscape ever since. The worm contains several features that make it difficult to detect, like using dozens of subject lines. It also "spoofs" e-mail addresses so it appears an infected e-mail message is coming from one person when in fact it's coming from a different system. Klez also searches infected machines for e-mail addresses in everything from documents to cached Web pages. It then mails copies of itself out to the various addresses using its own SMTP engine. Additionally, some variants of Klez dropped the Elkern virus, which targets executables, into systems while spreading. "Klez-H and its nasty bedfellow ElKern-C, have accounted for almost a quarter of enquiries to Sophos' support center this month, even though protection has been available since February," said Sophos in a release. "Users getting caught out by them appear not to have updated their anti-virus software in six months." Likewise, Command Central saw Klez accounting for 79.2% of virus activity in April but by its calculations W32/Yaha.E surpassed Klez in August. "After five months, we have finally seen a switch at the top as W32/Yaha.E surpasses Klez securing the pole position," said Steven Sundermeier product manager at Central Command, Inc. W32/Yaha.E travels in e-mail messages with a love- or friendship-themed subject line. It can also exploit security holes in MSN Messenger and ICQ instant messaging. "Peer-2-Peer networks like ICQ and MSN Messenger in conjunction with file sharing networks like Napster and Kazaa are beginning to play a pivotal role in the distribution of this latest breed of viruses in 2002," Sundermeier said. Below are the monthly virus numbers from different antivirus vendors (including Sophos and Command Central): Sophos' top list of viruses for August:
MessageLabs top ten malicious code for the last four weeks (through Sept. 2):
Command Central's most prevalent viruses list:
Trend Micro's top list of viruses for the last 30 days (through Sept. 2):
Kaspersky Labs 's top 20 list of viruses and worms for August by occurrence:
|
|
|
|
||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||
|
|||||||||||||||||||||||||||
| |||||||||||||||||||||||||||
|
|
|
|||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||
