The top ten viruses in 2003.

Types of malicious programs

Throughout the year worms remained the dominant type of malicious programs. Viruses rank second, thanks to the activity of the macro viruses Macro.Word97. Thus and Macro.Word.Saver. However, in the autumn of 2003 Trojan programs overtook viruses, and this trend still continues.

Trends

The most noticeable trend in 2003 was the way in which worms dominated. Moreover, within this category, there was a worrying increase in the number of Internet worms over classic email worms.

Kaspersky Labs predicts that this trend will be maintained, and Internet worms should become the dominant form of malicious code in 2004. This highlights the utter necessity to install not only anti-virus protection, but also firewalls on every computer and corporate network.

The discovery of breaches in operating systems and applications is a cause for great concern. In previous years, the vulnerabilities which were used to penetrate systems had been known about for a long time, and patches already existed for the breaches, but in 2003 this time frame collapsed to a matter of weeks.

The interval between the discovery of a vulnerability and an attack exploiting the vulnerability is becoming shorter and shorter. In the case of Slammer, the breach in the Microsoft SQL Server was known about for more than six months prior to the attack, in a couple of months the instructions on how to exploit the breach were published in several places on the Internet. However, Lovesan, the next worm used to attack the Internet on 12th August 2003, appeared only 26 days after a patch was issued to secure the RPC DCOM vulnerability in MS Windows.

The computer underground has come to the understanding that attacking through a security breach is the most effective method of penetrating computers and is actively making use of this idea As a result virus writers receive information about the newest vulnerability and quickly write malicious programs. The Trojan program 'StartPage' was registered as spreading on 20th May 2003. It penetrated through the 'Exploit. SelfExecHtml breach, and at the time there was no patch for this vulnerability. Given this, it may be that in the neat future breaches may come to light thanks to reports of new viruses, rather than vendors' reports on the issuing of patches

In 2003, the tendency of the previous year towards malicious programs for new platforms and applications was broken. In 2002, virus writers attacked Flash technologies, SQL Servers, and file sharing networks (Kazaa). This year virus writers confined themselves to attacking the cartographic application MapInfo:

MBA. Kynel, a virus written by a Russian in MapBasic managed to successfully infect documents of this format and was even discovered by Kaspersky Labs in the wild.

The trend of 2002 towards backdoor programs (unauthorised remote administration utilities) and spy programs continued. The most notable representatives of these classes were Agobot and Afcore. There are currently more than 40 modifications of Agobot due to the fact that the program's author was able to create a network of several web sites and IRC channels, where anyone who wanted was able to become the owner of an exclusive version of the backdoor for payment upwards of $150. The malicious software would he written to order in accordance with the order of the client.

The Top Ten Viruses In 2003

1.  1-Worm.Sobig        18.25%
2.  1-Worm.Klez         16.84%
3.  1-Worm.Swen         11.01%
4.  1-Worm.Lentin        8.46%
5.  1-Worm.Ta"os         2.72%
6.  1-Worm.Avron         2.14%
7.  Macro.Word97.Ihus    2.02%
8.  1-Worm.Mirnail       1.45%
9.  1-Worm.Hybris        1.12%
10. 1-Wom.Roron.         0.01%

www.kaspersky.com