The Deadly Duo: Spam and Viruses, April 2005

Spam volume remained high in April, averaging 84.6 percent of total inbound email, according to FrontBridge. The company saw an all-time record daily high of 94 percent on April 10. The company attributes the overall rise in spam volume to Russian-language and stock offer spam.

Stock tips seem to have been revived by spammers as a form of social engineering (define) after experiencing a degree of success last year. Over a quarter of all spam was comprised of bogus stock tips last month, according to Clearswift. Stock tips put a dent in other spam segments; porn spam accounted for 5.62 percent of spam volume, while pharmaceuticals dipped slightly to 33 percent.

Phishing (define) was reported down 45 percent over the last month by Postini. “We still consider it to be a very serious threat,” observed Andrew Lochart, the company’s senior director of marketing. “Phishing requires more skill from the spammers, which has limited it so far to just one percent of all spam. But due to the potential for substantial gain, in the long run, we expect phishing attacks to increase in number and become increasingly more sophisticated in nature.”

Click to view full-size chart

Directory harvest attacks (DHAs) maintained a steady volume throughout the month, according to the same company.

Preliminary numbers from MessageLabs report the global ratio of spam was 68.8 percent of all email, and puts email-borne viruses at 2.3 percent.

Viruses

A few anniversaries were marked on the virus front. Eight years ago, the first protected-mode virus was detected in Russia. It soon died out, despite predictions it would develop further. The Loveletter worm has survived five years and continues to circulate. Central Command points out the sophistication of worms has gradually increased over the years, as have the reasons for writing viruses.

“To date, I-Worm.Loveletter is still seen ’in-the-wild,’ not bad longevity,” said Steven Sundermeier, VP of products and services at Central Command. “Variants of the Loveletter are still being created, though most of them simply get detected generically at this point.”

Top 10 Viruses Reported to Sophos, April 2005
Rank	Virus	Reports (%)
1	W32/Zafi-D	46.6
2	W32/Netsky-P	20.6
3	W32/Zafi-B	4.5
4	W32/Netsky-D	4.5
5	W32/Netsky-Z	2.5
6	W32/Netsky-B	2.4
7	W32/Mytob-Z	1.3
8	W32/MyDoom-O	1.2
9	W32/Netsky-C	1.1
10	W32/Netsky-Q	1.0
	Others	14.3
Source: Sophos Plc., 2005

The top ten viruses posted by Sophos show the Zafti-D variant remained the most distributed in April at 46.6 percent. A new virus, Mytob-Z, reached number seven on the list.

Top 10 Viruses Found on Computers, April 2005
Rank	Virus Name	Number of Viruses Found
1	TROJ_SMALL.AFG	259,620
2	HTML_NETSKY.P	89,294
3	WORM_NETSKY.P	44,837
4	JAVA_BYTEVER.A	34,291
5	HKTL_BRUTFORCE.A	23,732
6	SPYW_GATOR.D	23,614
7	ADW_WEBSEARCH.B	21,068
8	SPYW_GATOR.C	18,496
9	SPYW_INVKEY12.A	17,804
10	WORM_MOFEI.B	17,773
Source: Trend Micro, May 2005