During the month of May we've seen a 346% growth over April of unique samples
actively circulating and infecting users (23.550 samples in May vs. 6.809 in April). Out of the total seen
In-The-Wild only a portion are new and
not seen in previous months, of which 78% are
non-replicating while the rest are self-replicating viral/worm
code. We encourage you to visit our Virus Encyclopedia to get detailed descriptions of each one of these.
New Replicating Malware
The ranking of new replicating viruses and worms this month is led by the W32/Lineage and W32/Autorun families. This last one consists of worms which replicate via USB devices and is the newcomer to the top of the list. Who said worms are
dead? The rest as usual is made up of MSN worms, spammer bots and an old acquaintance W32/Bagle still making the rounds.
**** W32/Lineage
**** W32/Autorun
*** W32/Sdbot
*** W32/Nuwar
*** W32/Mandaph
*** W32/MSNWorm
** W32/Spamta
** W32/Socks
** W32/Nahkos
** W32/IRCBot
** W32/Gaobot
** W32/Bagle
** VBS/Autorun
* W32/Wow
* W32/VB
* W32/Rxbot
* W32/ProxyServer
* W32/Perwall
* W32/Mailworm
* VBS/Solow
New Non-Replicating Malware
On the Trojan front, we've seen a strong increase in infections by Identity Theft Trojans (Sinowal, Banker, Agent, Dadobra, Banbra, etc.) while the pay-per-install adware/spyware affiliates are having a hard time maintaining their number one position. I guess it pays more to steal directly from consumers' bank accounts. The rest of the list is made up by spammer bots, rogue anti-spyware and other creatures.
**** Trj/Lineage
**** Adware/Netproject
*** Trj/dmRandom
*** Trj/Sinowal
*** Trj/QQpass
*** Trj/Nabload
*** Trj/Downloader
*** Trj/Banker
*** Trj/Autorun
*** Trj/Agent
*** Spyware/Virtumonde
*** Bck/IRCBot
*** Adware/VapSup
*** Adware/NaviPromo
** Trj/Spambot
** Trj/Ranky
** Trj/Qhost
** Trj/Dadobra
** Trj/Buzus
** Trj/Banbra
** Trj/Agysteo
** Generic Malware
** Bck/Sdbot
** Bck/Hamweq
** Bck/Agent
** Adware/VideoPlugin
** Adware/BHO
* Trj/WmaDownloader
* Trj/VBbot
* Trj/Spy
* Trj/Spammer
* Trj/Passwordstealer
* Trj/Multidropper
* Trj/Mitglieder
* Trj/Killfiles
* Trj/Dropper
* Trj/DNSChanger
* Trj/Clicker
* Trj/Busky
* Trj/BedeTres
* Generic Trojan
* Dialer
* Bck/VBBot
* Bck/Turkojan
* Bck/Tiny
* Bck/Peacomm
* Bck/Nepoe
* Bck/Hupigon
* Bck/Gaobot
* Bck/Dbot
* Application/WinSpywareProtect
* Application/VirusHeat
* Adware/Zenosearch
* Adware/Yazzle
* Adware/WinSpywareProtect
* Adware/WinReanimator
* Adware/WinIFixer
* Adware/WinAntiVirus2007
* Adware/VirusRanger
* Adware/VirusHeat
* Adware/VideoKeyCodec
* Adware/VideoAccessCodec
* Adware/UltimateDefender
* Adware/SecurityError
* Adware/SearchPorn
* Adware/RussiaPorn
* Adware/PCCleaner
* Adware/MalwareAlarm
* Adware/Lop
* Adware/Ivideo
* Adware/BraveSentry
* Adware/AntiSpywareShield
* Adware/Alexa
* Adware/AdvancedXPFixer
* Adware/4Porn