Tech Shout!

Panda Software has unveiled the ranking of the viruses and spyware most recurrently detected by the Panda ActiveScan online security solution in 2005.

Sdbot.ftp ranks first in the malware ranking and had retained the first position for the last six months. This generic detection of the variants of the Sdbot worm, downloaded via FTP, was responsible for 3.7% of infections.

Netsky.P. ranks second to Sdbot.ftp. Since this worm first appeared in 2004, it has remained in the monthly list of most frequently detected viruses, inspite of exploiting a vulnerability in Internet Explorer which was detected and solved some years ago.

Third is the Qhost.gen is a generic detection of a modification of the file HOSTS, which belongs to the Windows operating system. The fourth place is held by Gaobot.gen, which is a generic detection for worms from the Gaobot family that exploit several software vulnerabilities.

The complete ranking is as follows:

- W32/Sdbot.ftp
- W32/Netsky.P.worm
- Trj/Qhost.gen
- W32/Gaobot.gen.worm
- Trj/Citifraud.A
- Trj/Zapchast.D
- W32/Parite.B
- W32/Netsky.D.worm
- W32/Sasser.ftp
- VBS/Psyme.C

Panda said that the following conclusions could be drawn from the Top Ten ranking of viruses most frequently detected by Panda ActiveScan in 2005:

- Balance between Trojans and worms. As compared to previous years computer worms were more prominent in the ranking of frequently detected viruses, 2005 has witnessed a more even balance. This tendency has also been seen from month to month.

- Botnets and financial fraud as growing threats. With Sdbot (a typical example of a bot) in first place and the presence of malicious code such as Citifraud.A, designed to carry out phishing attacks, in the ranking, it is clear that there has been a change of inspiration for the creators of malicious code, they now search for financial returns above all else.

- Poorly protected computers, a persistent threat. The sustained presence of veteran malicious code such as Parite.B and Sasser, or those like Netsky.P that exploit software vulnerabilities (which have long ago been resolved) discloses just how many computers are still poorly protected. This creates a favourable environment for virus creators to spread new malicious code.

With respect to spyware, the most frequently detected in 2005 are New.net, Cydoor, Betterlnet and Altnet.

- New.net
- Cydoor
- BetterInet
- Altnet
- Petro-Line
- MarketScore
- Virtumonde
- Media-motor
- Aveo-Attune
- Aureate-Radiate