Kaspersky Labs Virus Top 20 for January 2004

1 New I-Worm.Mydoom.a 78,32
2 -1 I-Worm.Swen 6,57
3 -1 I-Worm.Mimail.c 3,63
4 +2 I-Worm.Sober.c 2,11
5 -1 I-Worm.Mimail.a 1,96
6 New I-Worm.Bagle 1,12
7 – I-Worm.Klez.h 0,80
8 -4 I-Worm.Mimai.g 0,74
9 – I-Worm.Sobig.f 0,54
10 -5 I-Worm.Tanatos.b 0,34
11 +3 I-Worm.Lentin.j 0,30
12 re-entry I-Worm.Lentin.g 0,27
13 -5 I-Worm.Lentin.m 0,26
14 New Macro.Word97.Swatch.b 0,23
15 -5 I-Worm.Dumaru.a 0,22
16 -4 Macro.Word97.Thus-based 0,22
17 -4 Macro.Word97.Saver 0,21
18 -3 I-Worm.Lentin.o 0,20
19 New I-Worm.Dumaru.j 0,15
20 -9 I-Worm.Mimail.j 0,15
*Other malicious programs 1,64

Mydoom unarguably led the virus hit-parade in January. The worm appeared on January 27 and accounted for more than three quarters of all infections. In fact, within a week Mydoom beat all the statistics produced by Sobig.f, last year’s leader.

We have three other newcomers to the top twenty: Bagle, Swatch.b and Dumaru.j. Bagle would have topped the charts with the outbreak it caused in mid-January, if it hadn’t been for Mydoom. The appearance of a macro-virus, Swatch.b in the top twenty is particularly noteworthy, as it was first detected in the wild in September 2003, but this is the first time it has surfaced in the top 20.

It is difficult to say why Swatch.b jumped in the ratings; however, two other macro-viruses also made it into the top twenty which seems to confirm that rumours of the demise of MS Word macro-viruses are premature. The latest version of Dumaru, Dumaru.j is the final new entrant on our list this month.

These four new viruses, taken together with the return of Lentin.g, have completely squeezed out traditional file viruses and backdoors.

Mydoom.a easily pushed aside the previous leaders, Swem and Mimail.c. In the meantime, Sober.c is following in the footsteps of the original Sober: Sober.a started in sixth place, moved to fourth place and finally disappeared from the top twenty entirely. Sober.c was in sixth place in December, and is currently in fourth place – where will Sober.c be in February?

Last year’s leader, Sobig.f has still not surrendered. Sobig was ninth in December and remains in this position in January; this is especially interesting as Sobig.f was scheduled to de-activate on September 10, 2003.

Overall, malicious programs have started 2004 with record highs. We are left wondering what next month will bring.