‹header›
‹date/time›
Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
‹footer›
‹#›
This is the total count of viruses. 
The big leap in 98 was due a virus writer using a virus generator producing 14000+ variants.
Percent increase has diminished significantly.  More worms, more complex viruses, kiddies more likely using backdoor programs rather than writing viruses.  CodeRed could have been written by a single person.  But Nimda definitely written by a group.
Better heuristics and generic detection.  So, fewer variants are sent into AV companies to be counted.
Lastly, due to size and speed considerations, we continue to improve our database by consolidating our detections, so the database doesn't grow as quickly.
Actual viruses spreading in the wild.
Summer of 1999, the start of many more mass-mailers.  Mass-mailers immediately make it into the wild, being seen all over the place right away.
ITW status has a 1-yr shelf life, with a 1-3 month bookkeeping (reporting) delay.  If it's not seen for a year, it goes off ITW.  Thus, the decline recently.  But slope of decline is less than slope rise in 2000, meaning more new viruses are replacing the ones that die.
Mass-mailers die off quicker than slow mailers.  So, effectively, a lot of mass-mailers will drop off the ITW list 15-18 months after discovery.  So, as the chart is starting to show, the decline is ending.
From the history of viruses just over a two year period we can see the movement has gone from the single infector moving slowly and infecting all that it can, to the multiple infector.
Each of these viruses was the first of it’s kind, or use a technique that was developed to spread viruses as quickly as possible, with the exception of CIH. It however was on of the most destructive viruses we have seen over the past two years, and its technique has been used in others mailer type viruses.
All of these viruses are still reported as being in the wild, and some are still the most prevalent.