Top 10 malware threats, hoaxes reported in April

Sophos has revealed the top 10 malware threats and hoaxes causing problems for businesses around the world during April 2006.

The report, compiled from Sophos`s global network of monitoring stations, reveals that Netsky-P, which recently celebrated its second birthday, has returned to the top of the virus chart, replacing Zafi-B, which Sophos first protected against 22 months ago.

However, as a proportion of all malware, e-mail viruses and worms continue to decline, 86% of the threats reported to Sophos during April were Trojan horses, used by hackers to download malicious code, spy on users, steal information or gain unauthorised access to computers.

The top 10 viruses in April 2006 were as follows:
1. Netsky-P (18.5%)
2. Zafi-B (16.9%)
3. Nyxem-D (8.5%)
4. MyDoom-AJ (3.9%)
4. Netsky-D (3.9%)
6. Mytob-FO (3.6%)
7. Mytob-C (2.8%)
8. Mytob-Z (2.6%)
9. Dolebot-A (2.2%)
10. Mytob-AS (1.3%)
Others: 35.8%

"While e-mail worms occupy the top spots, it`s clear that Trojan horses represent the most prominent threat," says Brett Myroff, CEO of local Sophos distributor, NetXactics. Trojans are also constantly being fine-tuned by hackers to catch out specific targets and, as they are likely to be more difficult to identify, there`s a danger that more individuals will make the mistake of clicking on an unsolicited attachment or a dubious Web link.

Sophos found that at least 28% of threats reported during April allow an unauthorised third party to access the computer remotely - further evidence that hackers are now primarily motivated by financial or data theft rather than simply to cause disruption.

"The fact that fewer mass-mailing worms are being created while cyber criminals are focusing their efforts on smaller, targeted attacks, has meant that long established threats continue to dominate the top 10. This proves that many computer users are still failing to update their protection and remove the risk of infection from these old nasties," Myroff says.

Netsky-P is still going strong 25 months on, and users with insufficient malware protection must take the brunt of the blame for giving it a continued lease of life.

"While greater education is helping bring some users up-to-speed on IT security threats, Netsky and Zafi continue to linger, and many may wonder if Microsoft will strike the killer blow to these worms when it releases its Windows Vista operating system in 2007."

Security has long been publicised as the major addition in the next instalment of Microsoft`s widely-used Windows operating system; however, details are still emerging as to how all-encompassing the new Vista security features will be, or the potential impact on malware designed for older versions of Windows.

"It`s important to remember that as older threats are vanquished, others invariably take their place," explains Myroff. "While mass-mailing worms may be in decline, it`s highly unlikely that they will disappear entirely. The introduction of a major new operating system may even spark a new wave of threats, as virus writers try to find holes in the product."

Elsewhere in the virus chart, there are re-entries for two Mytob variants, Mytob-C and Mytob-AS, while another e-mail worm, Dolebot-A, enters the chart for the first time in ninth position, accounting for 2.2% of all viruses reported. Sophos`s research shows that 0.7%, or one in 141 e-mails, is viral. The company now identifies and protects against a total of 121 096 e-mail threats, an increase of 1 054 on last month.

The top 10 hoaxes and chain letters in April 2006 were as follows:
1. Hotmail hoax (13.5%)
2. Music Top 50 (11.2%)
3. Olympic torch (9%)
4. Meninas da Playboy (6.3%)
5. Bonsai Kitten (5.2%)
6. MSN is closing down (4.9%)
7. Justice for Jamie (4.4%)
8. Budweiser frogs screensaver (3.2%)
9. Bill Gates fortune (3%)
10. Paying for MSN (2%)
Others: 37.3%

It`s a return to the top of the charts for the Hotmail hoax this month, while the Dutch language Music Top 50 chain letter has grown in prevalence, clogging bandwidth and wasting computer users` time. The chain letter purports to be from a new television programme, and falsely promises a free Discman for recipients that forward the e-mail to others. "Given that we`re now firmly in the age of the iPod, it`s surprising that such outdated hoaxes continue to fool people - our advice is if an offer sounds too good to be true, it probably isn`t the real deal," Myroff says.

Graphics of the above top 10 virus chart are available at www.sophos.com/pressoffice/imgallery/topten.

For more information about safe computing, including anti-hoax policies,

please visit www.sophos.com/virusinfo/bestpractice/.