New threats top April malware charts

Malware showed 'renewed vigour' last month

Clement James, vnunet.com 14 May 2007

ESET, a security firm based in Bratislava, warned today that April showed "renewed vigour" in terms of malware threats.

The top five new threats represented nearly 14 per cent of all threat activity for the month, according to the company.

In first place was the much publicised Ani.Gen Trojan, which exploits the way in which Windows handles animated cursor (.ani) files.

Close to five per cent of all detections in April were Ani.Gen, as malware writers made the most of this latest vulnerability in Microsoft's operating system.

"This type of attack exposes even fairly sophisticated users to drive by attacks that can compromise their computers," said Randy Abrams, director of education at ESET.

"The use of virtualisation technologies such as SandboxIE for web browsing can afford some protection, but email still remains a potential attack vector.

"Although forcing Outlook to render email in plain text is a mitigating tactic, Outlook Express will remain vulnerable even when configured to render email in plain text."

The PSW.Agent.NCC Trojan dropped from first place last month to second this month, accounting for 2.85 per cent of all detections during April.

This Trojan is part of a family used for stealing passwords through key-logging techniques. In third place was Win32/Pacex.Gen, a remarkably fast spreading mass-mailing worm discovered in March.

Botnet downloader Agent.AWF was fourth in April, with around 1.8 per cent of detections. This threat is used for downloading other malware from sites to create botnets for propagating spam and delivering distributed denial-of-service attacks.

Fifth place in April was Win32/Perlovga, a Trojan that has increased its presence during the current year.

Moving up from seventh place last month, Perlovga can be received by email, FTP or P2P applications. It is used to collect sensitive information from infected computers.

See also: