Top Ten viruses most frequently detected by...

07/30/2004. The Downloader.GK Trojan is once again the most frequently encountered malicious code

This July certainly wasn’t the quietest of months in terms of computer viruses. In fact, over the last month, users have had more than just the odd scare, such as those caused by Bagle.AH and Mydoom.N.

Nevertheless, none of the new viruses managed to overtake Downloader.GK, which once again topped the list of the viruses most frequently detected by Panda ActiveScan, the free online scanner. This malicious code was found to be responsible for almost 16 percent of all infections.

Second and third place in the ranking were filled by two Trojans that also figured in June’s Top Ten. Briss.A and StartPage.FH were the culprits in 8.85 and 8.68 percent of attacks on users’ computers.

The highest worm in last month’s ranking was in fourth place. The infamous Netsky.P was the culprit in almost seven percent of infections. In fifth place came Sasser.ftp (6.74%), the script created by the Sasser worms in order to download themselves via FTP to the affected computer. After this came Gaobot.gen (5.15%), a generic detection of the Gaobot family of worms.

Three of the last four places in the Top Ten were occupied by Trojans: Downloader.JH (4.71%), Qhost.gen (3.52%) –another generic detection-, and Downloader.HC (3.21%) and tenth place was held by the recently-appeared Bagle.AH (2.87%)

The following conclusions can be drawn from the data collected by Panda ActiveScan last month:

- July: the month of Trojans:

Not only was the most frequently detected malicious code -Downloader.GK- a Trojan, but of the 9 others, 5 were also Trojans. This would indicate that there are a growing number of cyber-delinquents out and about, as among other malicious action, many Trojans specialize in helping crooks to steal confidential data such as bank or credit details, which can be then be used to perpetrate frauds.

- Dangerous variants:

Three of the malicious code in the ranking were from the Downloader family of Trojans. This highlights the current trend for virus creators to create many variants of a malicious code to put as many viruses as possible in circulation at the same time, thus increasing the chances of computers being infected.

Virus
% frequency

Trj/Downloader.GK
15.74%

Trj/Briss.A
8.85%

Trj/StartPage.FH
8.68%

W32/Netsky.P.worm
6.87%

W32/Sasser.ftp
6.74%

W32/Gaobot.gen.worm
5.15%

Trj/Downloader.JH
4.71%

Trj/Qhost.gen
3.52%

Trj/Downloader.HC
3.21%

W32/Bagle.AH.worm
2.87%

To help as many users as possible keep their systems virus free, Panda Software offers Panda ActiveScan, free of charge, at http://www.pandasoftware.com/. Webmasters who would like to include ActiveScan on their websites can get the HTML code, free of charge, from http://www.pandasoftware.com/partners/webmasters/

Panda Software also offers users Virus Alerts, an e-bulletin in English and Spanish that gives immediate warning of the emergence of potentially dangerous malicious code. To receive Virus Alerts just visit Panda Software´s website (http://www.pandasoftware.com/) and complete the corresponding form in the Virus Alerts section.

For more information about these and other viruses, visit Panda Software´s Virus Encyclopedia at: http://www.pandasoftware.com/virus_info/encyclopedia