"Viruses that include spyware characteristics and provide backdoor access over and above what a virus does, gives you a saleable commodity in the same way a botnet would; it is something you can rent out to the highest or lowest bidder," Ducklin said.

"I don't know if one can prove this definitively but if you look at the broader picture we see more and more cases in which malware gets a smaller distribution.

"I suspect virus writers with an organized criminal bent don't want another Blaster or Sasser, because it is counterproductive and affects their ability to compromise machines."

Ducklin said Blaster and Sasser aren't suitable for a criminal harvest because they spread too far and went out of control.

"This results in users taking the problem seriously and doing something about it," he said.