Kaspersky unveils Top Twenty

Johannesburg, 05 Mar 2009

Kaspersky Lab has released its Top Twenty threats report for February, which features a number of important changes compared to previous rankings.

“First of all, the network worm Kido, which caused an epidemic that started in January and is still going strong, has gained impressive ground. Detection routines for this worm were added to anti-virus databases in mid-January, and, therefore, the bulk of infected files were detected in February,” says the company.

Kaspersky says there are three interesting newcomers to the ranking, namely Packed.Win32.Krap.g, Packed.Win32.Klone.bj and Packed.Win32.Tdss.c.

These three newcomers are associated respectively, with detections for a variant of a compression utility for Magania Trojans, (a very common family which steals passwords to online games), a certain type of obfuscation for AutoIT scripts, and an entire class of programs encrypted using the new malicious packer TDSS.

Kaspersky says the last of the three pieces of malware is interesting in that the original, un-encrypted malicious programs can be of any type, including but not limited to Trojans, worms and rootkits.

“All malicious, advertising and potentially unwanted programs in the first Top Twenty can be grouped according to the main classes of threats we detect,” the company adds. “There has been almost no shift in the balance between these classes since January. Statistics for the past several months show that the number of self-replicating programs has remained uniformly high.”

In total, Kaspersky Lab detected 45 396 unique malicious, advertising, and potentially unwanted programs on users' computers in February, a number it says is not significantly different from January's figure.

The Top Twenty is based on data collected by Kaspersky Lab's version 2009 anti-virus product. The ranking is made up of the malicious programs, adware and potentially unwanted programs most frequently detected on users' computers.