According to ESET, unlike the fairly broad threat profile for March, April showed renewed vigour among new threats, with the top five representing nearly 14 per cent of all threat activity for the month.

The most widespread malware was Win32/TrojanDownloader.Ani.Gen, which exploits how Windows handles animated cursor (.ani) files. During the month of April, close to 5 per cent of all detections were of the Ani.Gen threat, as malware writers made the most of this latest vulnerability in the operating system.

According to an ESET spokesman, this type of attack exposes even fairly sophisticated users to "drive by" attacks that can compromise their computers. For web browsing, the use of virtualization technologies such as SandboxIE can afford some protection, but email still remains a potential attack vector. Although, forcing Outlook to render email in plain text is a mitigating tactic, Outlook Express will remain vulnerable to attack, even when configured to render email in plain text.

Win32/PSW.Agent.NCC, dropped from first place last month to second, account for 2.85 per cent of detections during April. This trojan is part of a family used for stealing passwords through keylogging techniques. In third place is Win32/Pacex.Gen, a remarkably fast spreading mass-mailing worm discovered during March.

Top 10 Threats for April 2007:

1. Win32/TrojanDownloader.Ani.Gen - 4.95 per cent
   
2. Win32/PSW.Agent.NCC - 2.85 per cent
   
3. Win32/Pacex.Gen - 2.21 per cent
   
4. TrojanDownloader.Agent.AWF- 1.80 per cent
   
5. Win32/Perlovga - 1.45 per cent
   
6. Win32/Adware.Boran - 1.30 per cent
   
7. Win32/PSW.QQRob - 1.27 per cent
   
8. Win32/Nuwar.gen - 1.18 per cent
   
9. Win32/Netsky.Q - 1.17 per cent
   
10. Win32/Adware.Virtumode - 1.14 per cent

ESET's ThreatSense.Net reports detection statistics from millions of client computers around the world and is believed to be the most comprehensive malware reporting system in existence. From an original idea, realised in VIRUS RADAR, ThreatSense.Net, includes data about all types of threats seen attacking user systems, not just those transmitted via email.

The (anonymous) statistical information is collected from NOD32 users who enable the reporting service in the product, and it gives a comprehensive view of the behaviour and spread of malware in the real world. Currently data is collected from more than 10 million systems, and has tracked more than 10,000 different threats and malware families.

Related links: (Open in a new window.)
www.virusradar.com
www.eset.co.uk

View printable version (opens in new window)
Back