Worms turn as Trojans take over

Rise of the botnet

Iain Thomson, vnunet.com 05 Jan 2005

Worms have fallen out of favour with virus writers to be superseded by Trojans as the most virulent malicious code, according to antivirus firm Panda Software.

The Downloader.GK Trojan has topped the company's 2004 problem chart, accounting for 14 per cent of reported incidents. The next most common infection, the Netsky worm, managed less than half this level.

The Downloader Trojan is transferred when the user visits a website using a poorly patched browser. Once downloaded it activates a spyware program called BetterInet, and software called SearchCentrix which generates pop-up advertising.

"Trojans are very much on the up," said Professor Neil Barrett of Cranfield University's computer science department.

"They have become the tool of choice for spreading malicious code, including Java applets from web pages. This has links with the efforts of spammers and phishers to boost visits to certain websites."

But Professor Barrett also pointed out that part of the reason for the increasing numbers of Trojans is that advertising software is now included in the statistics.

Until recently many security specialists did not classify advertising software with Trojans because it caused no harm to the user's PC.

There were four Trojans affecting browsers and common applications in the top 10 last year, accounting for nearly a quarter of all problems, according to Panda.

Top 10 for 2004

1. Downloader.GK (14 per cent)
2. Netsky.P (6.92 per cent)
3. Sasser.ftp (4.97 per cent)
4. Gaobot.gen (4.31 per cent)
5. Mhtredir.gen (4.22 per cent)
6. Netsky.D (3.98 per cent)
7. Downloader.L (3.56 per cent)
8. Qhost.gen (3.48 per cent)
9. Netsky.B (3.45 per cent)
10. StartPage.FH (3.34 per cent)