Published: March 20, 2006

February Virus and Spam Statistics: Swift Virus Attacks Continue to Gain the Upper Hand

Share This Story

Signature-Busting Viruses Penetrate Before Anti-Virus Signatures Are Updated

2 out of 3 Emails Are Spam

Commtouch® (NASDAQ: CTCH), the developer of the ground-breaking RPD(TM) technology for real-time anti-spam and Zero-Hour(TM) virus protection, today announced spam and computer virus statistics for the month of February 2006. The data is based on information continuously gathered by the Commtouch Detection Center, which analyzed more than 2 billion messages from over 130 countries during the month of February.

Nine signature-busting virus attacks

"Out of over twenty-five new virus attacks observed in February, nine can be classified as 'signature-busting attacks,'" explains Amir Lev, Commtouch's President and CTO. "These are viruses with a distribution mechanism engineered especially to break in before anti-virus companies manage to create and update their installed products with a new signature."

Of these nine attacks, four were rated "low intensity," three were rated as "significant," one attack was rated as "medium-high," and another as "massive."

Anti-virus engines demonstrate problematic response time

The amount of time it takes for a virus to be distributed varies, though typically the fiercer attacks are also spread more rapidly: 'Low Intensity' attacks took 7 hours to 2 days; 'significant' attacks took 1 hour to 1 day; and 'medium' to 'massive' were swiftly spread in 3 to 5 hours.

Based on real-time testing data received from AV-Test.org, a reliable independent lab, Commtouch was able to compare detection times of more than 30 leading anti-virus engines against new viruses released in February. The results were as follows:

--  Each of the 9 attacks mentioned above was completely missed/ignored by
    at least two of the anti-virus engines (i.e. signature was not released at
    all by the time the attack had already finished). Two attacks that were
    rated "significant" were missed by more than 20 (60%) of the tested
    anti-virus products.

--  5 of the new virus attacks were defined as "short span": in these
    cases, the entire attack lasted between 3 to 7 hours. The average length of
    a short-span attack was 4.6 hours, and the average response time of all the
    tested anti-virus products was over 6 hours -- on average, signatures
    arrived after the attack was completed.

--  One attack, also noted in Commtouch's January report, turned out to be
    a multi-wave attack that has been ongoing for three months. Its overall
    intensity is defined as 'medium-high,' bordering on 'massive' (the highest
    rate).

"This malware is continuously evolving," commented Lev. "It keeps changing the way it disguises itself from traditional signature-based and even heuristics-based anti-virus solutions." According to Commtouch and AV-Test.org data, this attack was completely missed by 12 (36%) of the tested anti-virus products.

Spam: accounts for 2 out of 3 emails

During the month of February, spam accounted for 46.4%, or almost half, of the entire email traffic of corporate users. This figure is calculated for the average user in thousands of corporations located in over 130 countries.

The consumer situation however is far worse: 71.5% of the emails received by the average consumer is spam (in a worldwide sample, covering over 5 million users).

The global average spam level for the month of February was 58.2%, almost 2 out of every 3 emails.

Of particular interest is the fact that the situation differs significantly between users in various regions. It appears that spam is most rampant in the United States and Russia, where about 75% of email traffic consists of spam. France and Hungary are the countries with the smallest volume of spam -- only 26% of total email traffic.

Spam origins

Compared to previous months, February spam statistics remained consistent, with the United States leading as the source of most spam messages. China's statistics show an increase of 1%, while Germany and Korea each accounted for approximately 4% of spam messages. The February spam origins ranking is as follows:

United States            43.70%
China                    13.63%
Germany                   3.90%
Republic of Korea         3.78%
France                    2.70%
United Kingdom            2.57%

Domains used by spammers -- favorites and familiar names

Highly consistent with findings from the previous month, spammers continue to abuse highly popular domains. In a sample of 258 million messages, Commtouch found 6.1 million samples allegedly sent from hotmail.com, 4 million from Yahoo.com, 1.7 million from Verizon.com, and between 1 and 1.5 millions from MSN, PayPal, Cisco, and Gmail.

Those interested in these and other statistics can find interactive charts, updated daily and available for downloading, at: http://www.commtouch.com/Site/ResearchLab/statistics.asp

February 2006 -- Major Spam Categories

Relaxing from the holiday craze, spam in the 'gifts' category fell to 3rd place and most spam during the month of January once again focused on 'traditional' topics, for example pharmaceutical (mostly Viagra and Cialis), leading the list at more than 50%. The February category ranking is as follows:

Pharmaceutical           52.22%
Enhancers                15.52%
Gifts                    14.41%
Finance                   8.09%
Porn, software, Misc      9.76%

About AV-Test.org

AV-Test.org is a joint research project of the University of Magdeburg and AV-Test GmbH. The Otto-von-Guericke University Magdeburg is located in Germany and has over 13,500 students. The tests are conducted in the research labs at the Workgroup Business Information Systems at the Institute of Technical and Business Information systems. Currently, the virus test lab has two professors and approximately 15 students working regularly on virus replication, analysis and tests of anti-virus products. AV-Test GmbH is a security consultancy company with a special focus on computer virus incidents.

For more information, see: www.av-test.org

About Commtouch

Commtouch Software Ltd. (NASDAQ: CTCH) is dedicated to protecting and preserving the integrity of the world's most important communications tool -- email. Commtouch has 15 years of experience developing messaging software, and is a global developer and provider of proprietary anti-spam and Zero-Hour virus protection solutions. Using core technologies including RPD Recurrent Pattern Detection, the Commtouch Detection Center analyzes billions of email messages per month to identify new spam and malware outbreaks within minutes of their introduction into the Internet. Integrated by over 30 OEM partners, Commtouch technology protects thousands of organizations, with over 35 million users in 100 countries. Commtouch is headquartered in Netanya, Israel and has a subsidiary in Mountain View, CA. For more information, see: www.commtouch.com, including the Commtouch online lab detailing spam statistics and charts.

This press release contains forward-looking statements, including projections about our business, within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. For example, statements in the future tense, and statements including words such as "expect," "plan," "estimate," "anticipate," or "believe" are forward-looking statements. These statements are based on information available to us at the time of the release; we assume no obligation to update any of them. The statements in this release are not guarantees of future performance and actual results could differ materially from our current expectations as a result of numerous factors, including business conditions and growth or deterioration in the Internet market, commerce and the general economy, both domestic as well as international; fewer than expected new-partner relationships; fewer than expected license agreements resulting from Commtouch's exclusive rights to market DCC; competitive factors including pricing pressures; technological developments, and products offered by competitors; the ability of our OEM partners to successfully penetrate markets with products integrated with Commtouch technology; a slower than expected acceptance rate for real time AV solutions in general and the Commtouch Zero-Hour(TM) Virus Protection product in particular; availability of qualified staff for expansion; technological difficulties and resource constraints encountered in developing new products, such as the Zero-Hour solution; and the failure of Commtouch to meet The NASDAQ Capital Market's listing standards in the future, as well as those risks described in the text of this press release and the company's Annual Reports on Form 20-F and reports on Form 6-K, which are available through www.sec.gov.

Recurrent Pattern Detection, RPD and Zero-Hour are trademarks, and Commtouch is a registered trademark, of Commtouch Software Ltd. U.S. Patent No. 6,330,590 is owned by Commtouch.