The Deadly Duo: Spam and Viruses, March 2003

There’s no relief in sight for Internet users, as spam attacks and viruses continue to inundate inboxes. Spam attacks have risen by nearly 4 percent from February to March 2003, according to measurements from BrightMail, and the company’s Probe Network counted 6,716,387 unique attacks for March 2003 – up from 6,458,065 in February – with the largest gain in the “Internet” category, and the largest decrease in the “Products” category.

Monthly 2003 Spam Category Data
Type of Spam	February	March	Change
Internet	3%	10%	+7%
Health	3%	9%	+6%
Leisure	3%	9%	+6%
Scams	5%	10%	+5%
Spiritual	2%	3%	+1%
Adult	19%	19%	0%
Other	5%	4%	-1%
Financial	26%	17%	-9%
Products	34%	19%	-15%
Source: Brightmail’s Probe Network

Brightmail defines the categories as follows:

• Internet- or computer-oriented emails are those that advertise related products or services, such as Web hosting, or design.
• The health category offers health-related products or services, such as herbal remedies or medical treatments.
• Leisure-related messages are those advertising prizes, awards, discounted travel, online games and casinos.
• Scam messages contain fraudulent or intentionally misguiding content.
• Spiritually oriented messages include offerings for psychics, organized religion, and astrology.
• Adult-oriented spam refers to offerings for offensive or inappropriate material, intended for persons over the age of 18.
• “Other” encompasses miscellaneous messages that do not pertain to any of the specified categories.
• Financial marketing messages are those that make reference to money, the stock market, credit reports, loans, and investments.
• Product-oriented messages advertise general goods or services.

Compounding the spam problem is the proliferation of emailed viruses. According to Central Command, Inc., new troublemakers emerged in March – Worm/Ganda and Worm/NiceHello.

Worm/Ganda is an Internet worm that was socially engineered to capitalize on the world’s current interest in the events of the Middle East. One of the randomly selected body messages claimed the attachment was a screensaver containing pictures taken by one of the U.S. spy satellites during a mission over Iraq.

Worm/NiceHello is an Internet worm that emailed itself to all addresses found within the MSN Messenger contact list. The email contents are written in Spanish.

“Central Command saw no major changes in this month’s Dirty Dozen,” said Steven Sundermeier, product manager of Central Command, Inc. “Remarkably, the Internet worms Worm/Klez.E and Worm/Yaha.E have remained number one and two, respectively, for the past five months. This is a clear indication that many users continue to ignore the importance of installing and maintaining up-to-date antivirus software.”

March 2003 Dirty Dozen
Rank	Virus	Percentage
1.	Worm/Klez.E (includes G)	21.6%
2.	W32/Yaha.E	10.8%
3.	Worm/Yaha.M	8.9%
4.	Worm/Avril.B	6.4%
5.	Worm/Sobig.A	6.3%
6.	Worm/Avril.A	5.8%
7.	Worm/BugBear	4.6%
8.	W32/Funlove	2.3%
9.	Worm/Yaha.L	2.0%
10.	Worm/Sircam.C	1.7%
11.	W32/Nimda	1.4%
12.	Worm/Badtrans.B	1.1%
	Others	27.1%
Note: The table represents the most prevalent viruses for March 2003, number one being the most frequent.
Source: Central Command, Inc.