VirusEye: The Message Labs Update

1: W32/Klez.H-mm – 476132
2: W32/Sobig.A-mm – 179019
3: W32/Yaha.K!e2a2 – 170225
4: W32/Yaha.E-mm – 81717
5: W32/Naith.B-mm – 19869
6: W32/Bugbear-mm – 17570
7: W32/Naith.A-mm – 17545
8: W32/SirCam.A-mm – 15574
9: W32/CIH.1049 – 6741
10: W32/Yaha.L!2095 – 5917

Commentary for February 2003
Given the events of the past month or so, the average virus writer appears to have spent the Christmas holidays and the early portion of the New Year inventing viruses while listening to Avril Lavigne!

Yes, the latest celebrity-related virus made its debut in January. Unlike the rather chirpy teenage rock star whose tunes put a spring in your step and a smile on your face, the Avril Lavigne virus was mean. The worm disabled security systems and stole personal passwords while masquerading as a Fan Club letter.

Even if the recipient were not enticed by the Avril Lavigne subject heading and decided to delete the message, the danger still hadn't passed. On an unpatched system, attempting to delete the virus could accidentally activate it. So opened or deleted, the virus would cause havoc.

Thankfully, our own technique of Internet level scanning prevents such a virus from encroaching on the in-box in the first place.

The Avril virus – otherwise known as 'Naith' or 'Lirva' – is a Windows-only worm which opens the singer's web site on the 7th, 11th and 24th of each month. This is but the latest example of female celebrities being used to entice system users to open an infected attachment.

Anna Kournikova, of course, tops the charts as the most successful case of a celebrity virus. When this particular virus was at its peak, it was crashing networks like dominos across the US and the UK, infecting an average of 1,000 PCs per hour.

The celebrity virus is definitely a continuing trend. Don't fall for the old siren trick, and think twice the next time you receive a celebrity-related e-mail.

Sobig: mass-mailing worm
January and February were busy months for viruses when compared with previous years. In the past, we have seen a marked downturn at this time of year (perhaps all of the virus writers join forces for a skiing holiday?!).

This year, on top of the Avril Lavigne virus, a mass-mailing worm entitled 'Sobig' spread rapidly at the beginning of the month. When activated, the worm forwards itself to all e-mail addresses it can find (searching documents as well as address books in the process). The program also attempts to download a back door Trojan which will give the hacker complete control of the infiltrated PC.

Worm attacks to the fore
In keeping with the beginning of the month, February ended with yet another worm attack. The Slammer worm attacked Microsoft's database software, resulting in complete chaos right across the globe as it affected cash machines at the same time as rendering the majority of South Korea offline!

Thus the damp January and February days brought the worms to the surface.

At the time of writing we couldn't be sure that LoveBug-style viruses would re-appear in time for Valentine's Day 2003, but we hope those security managers who regularly read this column would indeed have been on the look-out this time around.