Anti-virus (AV) vendors report that the Sasser Internet worm caused the most disruption worldwide in May, accounting for half of all virus reports received, while locally the virus market was fairly sedate.
In its 'dirty dozen' list of 12 most frequent viruses for May, AV vendor Central Command says Sasser was the most prevalent, accounting for 49% of all virus occurrences.
CEO of local Sophos distributor NetXactics, Brett Myroff reports that Sasser was responsible for 51% of all virus occurrences. "It's renowned for what it has done," says Myroff, adding that it was fairly quiet locally.
The worm, now in its fifth variant, initially emerged in late April as the first virus to infect PCs without any action on the part of the victim. An 18-year old German was arrested for creating the worm, but this did not prevent the latest variant being released into the wild.
Central Command Products and Services VP, Steven Sundermeier says Sasser spreads by exploiting a known Windows LSASS (Local Security Authority Subsystem Service) vulnerability, and is responsible for crippling thousands of Windows systems worldwide.
"Many spooked Windows 2000 and XP users found their computers continually rebooting for no apparent reason, a common sign of a Sasser infection," says Sundermeier.
Variants of the ever-present Netsky worm comprised more than half of the list of top viruses for May on both Central Command and Sophos' lists, with Netsky-P proving the most prevalent, accounting for more than 10% of virus occurrences internationally.
Sophos found a total of 959 new viruses globally during May - the highest number discovered since December 2001, says Myroff. Meanwhile, Central Command reported a total of "1623 different viruses, worms and malicious applications" during the same period.
Myroff believes there could be a number of reasons for this difference. "Central Command might be including aliases for the viruses, counting each variant as separate. I think the way viruses are reported is very subjective, and companies will report things differently."
On the local front, Y3K MD Ryan Price says May was a fairly sedentary month for virus attacks. "There were no massive problems. We just had single users reporting viruses - there weren't really any reports from our corporate clients." Price adds that Sasser was still the most prevalent virus locally.
Share
