An analysis of email antivirus logs for June reveals quite stark changes. An analysis of these changes is presented below.

1. Net-Worm.Win32.Mytob.c: 29.0 per cent
   
2. Email-Worm.Win32.Nyxem.e: 16.7 per cent
   
3. Email-Worm.Win32.LovGate.w: 8.6 per cent
   
4. Email-Worm.Win32.NetSky.b: 5.6 per cent
   
5. Email-Worm.Win32.LovGate.ad: 4.0 per cent
   
6. Net-Worm.Win32.Mytob.t: 2.9 per cent
   
7. Net-Worm.Win32.Mytob.q: 2.8 per cent
   
8. Net-Worm.Win32.Mytob.u: 2.1 per cent
   
9. Net-Worm.Win32.Mytob.x: 1.9 per cent
   
10. Net-Worm.Win32.Mytob.a: 1.9 per cent
    
11. Email-Worm.Win32.NetSky.y: 1.8 per cent
    
12. Email-Worm.Win32.NetSky.x: 1.6 per cent
    
13. Net-Worm.Win32.Mytob.v: 1.5 per cent
    
14. Net-Worm.Win32.Mytob.r: 1.4 per cent
    
15. Email-Worm.Win32.NetSky.q: 1.3 per cent
    
16. Net-Worm.Win32.Mytob.w: 1.1 per cent
    
17. Email-Worm.Win32.NetSky.af: 0.9 per cent
    
18. Net-Worm.Win32.Mytob.gen: 0.9 per cent
    
19. Net-Worm.Win32.Mytob.bx: 0.8 per cent
    
20. Email-Worm.Win32.NetSky.t: 0.8 per cent

• Other worms: 12.5 per cent/UL>
  The list displays considerable changes in comparison with May. It is not yet certain why these changes have occurred, but the Email Top 20 has not changed this much for a long while. Antivirus vendors issued a number of alerts during June, but most of these worms do not appear in the rankings. Take Bagle.fy, for instance, which Kaspersky also detects as Bagle.mail and Baglel.gen. This variant of Bagle was active in mid-June, although it appeared as a localized outbreak that lasted only a few days. A close look at the Top 20 shows that Bagle.fy did not make it onto the list. One reason for this could be that many contemporary worms reach their peak months after they first appear, which can be seen from the Nyxem.e case described below.
  

  Nyxem.e occupies the second place in the June rankings. Virus and industry analysts undoubtedly remember this worm well. It appeared in January 2006 and received a lot of media coverage. According to a number of antivirus vendors, Nyxem.e infected hundreds of thousands of machines around the globe, though mainly in India and Peru. Everyone waited with bated breath for February 3, when Nyxem was supposed to delete files on infected machines. The panic was so widespread that municipal authorities in Milan decided to leave their computers turned off on February 3. Fortunately, the expected outbreak did not occur. In fact, Nyxem did not even appear in the Top 20 for several months.
  

  It seems as though we could have simply forgotten about Nyxem.e. But it appeared in email traffic in early June and the numbers rose throughout the month to reach 17 per cent. As a result, Nyxem.e is now in second position. Users should take precautions on July 3rd, since the file destruction module is programmed to run on the 3rd of every month. Heightened awareness and strict adherence to standard security policies is advisable.
  

  The unexpected revival of Nyxem.e is only one of the unusual events during June. The dramatic fall of longtime leaders Netsky.q and Netsky.t is another surprise and a fascinating one at that.
  

  Netsky.q was the most widespread email worm in 2004 and has remained at the top of our ratings since then. Netsky.t rose rapidly at the beginning of 2006 and continued to rise until June. This month both worms dropped significantly with Netsky.q falling to 15th place and Netsky.t to 20th.
  

  Mytob.c continues to hold 1st place where it has been since February 2006. This month Mytob.c accounts for 30 per cent of malware in email traffic. It is unclear what will happen in the next few months with Nyxem.e pushing ahead, though Bagle.fy might also take a shot at the top spot. The advent of as yet unknown malware is less likely since email worms have been unfashionable among virus writers for over a year now, with the focus having shifted to Trojan-spyware.
  

  The percentage of other malware has dropped back down to 12 per cent, showing that popular worms are spreading more than less well known ones.

  Related links: (Open in a new window.)
  www.viruslist.com/en/analysis?pubid=189938636
  www.kaspersky.com
  

  View printable version (opens in new window)
  Back