Double the Trojans, Half the Worms

Detections of new Trojans have increased dramatically since 2004 to the detriment of worms, a type of malware that has been widely used to cause infections. In 2004, the ratio of new worms and Trojans detected by PandaLabs was 34.7% and 24.3% respectively. However, in 2005 the situation changed drastically, as the percentage of new Trojans rose to 40.3% and the percentage of new worms decreased to 25.6%. This trend has not only continued in 2006 but has also become increasingly apparent. Trojans already represent 47.8% of all new malware detected with worms only accounting for 17.1%.

"Trojans are an extremely versatile type of malware, as they can be designed to carry out a wide variety of malicious actions without users noticing. In this way, they can create backdoors that cyber-crooks can use to control other computers remotely, steal data entered by users to access web services, or even make changes to the system in order to take users to fake websites designed to steal personal data", says Jeremy Matthews, MD of Panda Software South Africa, who adds "Other types of malware such as worms usually have very visible actions, which draw the attention of the media as well as users, who immediately try to remove them from their systems. This is why this type of malware is not suitable for today`s cyber-crooks, who are looking for financial returns above all.

In addition, malware authors are not only concentrating their efforts in creating threats that provide financial returns, but also in distributing them in such a way that users will not notice. For instance, there is a growing number of websites designed to take advantage of vulnerabilities to introduce malware on the computers of users visiting them.

"At this moment it is necessary to complement traditional antivirus programs with proactive protection technologies capable of detecting malware without previously identifying it. Creators of malicious code know that it takes a few hours for security companies to come up with a vaccine to neutralize a new malware specimen once it is first reported. In this way, a malicious code that has not been identified by security companies can remain on a system for a long time, even when the antivirus is up-to-date.