• silicon.com
• Technology
• Security

By Pia Heikkila, 1 May 2002 14:00

NEWS The persistent Klez worm is, for the second month running, enemy number one for IT directors around the world. Figures for April from anti-virus software company Sophos reveal that Klez, despite being an old worm, still managed to infect more computers than any other malware during the month. The E and G variants of Klez have been around since November 2001, but the most commonly seen H variant, originally discovered back in October, has re-emerged over the last month. A study earlier this week from Panda Software found that the virus has infected 7.2 per cent of PCs, proving the worm is more virulent that originally thought. The H variant does not destroy any files, but installs code to make sure it will launch again. It spreads as an email attachment with various subject lines. It also carries other viruses such as Elkern, which it then drops once the attachment is executed. Other versions of Klez have featured time-activated payloads, which trigger the worm on a specific day of each month. Graham Cluley, senior technology consultant at Sophos Anti-Virus, said: "The various manifestations of the Klez worm dominate April's virus chart with variants taking up the number one, two and six slots. "Klez-H was the hard hitter, some commentators went so far as to call this the biggest worm in the world ever. In reality, the success of Klez-H is damning evidence that computer users are failing to keep their anti-virus software up-to-date." Badtrans kept its number three slot, infecting 4.7 per cent of computers worldwide. The particularly nasty hybrid viruses such as Nimda and Sircam remain in the top ten, infecting less than one per cent of machines. Sophos's list of the most commonly reported viruses is as follows:
1. W32/Klez-G (Klez variants G & H)
2. W32/Klez-E (Klez variant)
3. W32/Badtrans-B (Badtrans variant)
4. W32/Elkern-C (Elkern variant) )
5. W32/Magistr-B (Magistr variant)
6= W32/Klez (Klez)
6= W32/MyLife-F (MyLife variant)
8= W32/Magistr-A (Magistr variant)
8= W32/Sircam-A (Sircam variant)
8= W32/Nimda-D (Nimda variant)