The family of Mimail worms, geared to carry out ''phishing'' scams, littered the list of theworst viruses for last month. Anti-virus vendors report that the worms accounted for morethan a quarter of all virus reports in November.
''It is pretty unusual to have so many variants of the same worm in the top 10,'' saysGraham Cluley, senior technology consultant for Sophos, Inc., an anti-virus software companybased in Lynnfield, Mass. ''The author has been pretty successful in spreading the worm andhaving a big impact.''
Cluley says analysts believe the author of the Mimail worm has connections in the spamworld, since Mimail-L attacks anti-spam Web sites and goes so far as to suggest thatanti-spammers are involved in child pornography. ''They're trying to make anti-spammersineffective and put them out of business,'' adds Cluley. ''The worm has been fairlysuccessful at spreading, but hasn't had a dramatic impact on those Web sites. Theanti-spammers have put measures in place to avoid the denial-of-service attacks, and so farthe anti-spammers are winning the war.''https://o1.qnsr.com/log/p.gif?;n=203;c=204660766;s=9477;x=7936;f=201812281312070;u=j;z=TIMESTAMP;a=20392931;e=i Most of the Mimail variants, however, are built to line the author's pockets.
Steve Sundermeier, vice president of products and services at Central Command Inc., ananti-virus company based in Medina, Ohio., explains that the worms are written to stealingcredit card information and social security numbers.
''It's not a new technique but it's an increasing fad -- writing computer viruses toincrease financial gain rather than just boost an ego,'' adds Sundermeier. ''It's somethingwe need to keep an eye on.''
While Mimail littered the virus scene last month, the top ranked virus, according to atleast one anti-virus company, actually was the Sober-A worm.
Sober might have skimmed over the United States, but it hit hard in Europe, especially inGermany. Written largely in German, the worm contained special miming coding that allows itto initially evade detection. Anti-virus companies had to update scanning engines to detectthis miming type, and it quickly spread in the mean time.
''Sober-A cunningly disguises itself using a multitude of subject titles and messages,making it difficult to spot,'' says Chris Belthoff, a senior security analyst at Sophos.''It can even present itself in German if it thinks it is being examined on a German user'scomputer.''
Sophos' list of top 10 viruses, in order of first to tenth, is Sober-A, Mimail-C, Mimail-F,Dumaru-A, Mimail-A, Gibe-F, Nachi-A, Mimail-J, Klez-H, and Mimail-E.
Central Command's list, similarly, is Gibe-C, Sober, Klez-E, Mimail-G, MimailC, Hawawi-G,Mimail-I, Mimail-J, Mimail-H, and Bugbear-B.