HOME >> IT Security >> Computer Virus Incident Reports June 6, 2000 (abstract)
Computer Virus Incident Reports (abstract)
June 6, 2000
ISEC
Information-technology Promotion Agency
1. Computer Virus Incident Reports for May, 2000
This is a summary of Computer Virus Incident Report for May 2000, compiled by IPA: Information-technology Promotion Agency (President: Kengo Ishii).
Total number of reports: 900 (476 in April, 2,741 from January to May 2000.)
[306 in May 1999, 3,645 for the year 1999 (monthly average of 304), 1,551 from January to May 1999.]
[Cumulative number of reports from April 1990 to May 2000 is 14,583]
Circumstances:
The number of reports this month recorded the highest number ever (previous record was 490 for March 2000.) 346 reports of VBS/LOVELETTER virus, which was found during long holiday week, also recorded the highest number per virus kind per month.
Email was the most common source of virus with approximately96%of total reports, about 60% were emails from abroad. 33 kinds of virus were reported in May.
Most frequently reported viruses are VBS/LOVELETTER with 346 reports, followed by XM/Laroux with 104 (93 last month), and W32/PrettyPark with 98 reports (139 last month).
There were 5 kinds of new viruses reported to IPA in May: VBS/LOVELETTER, W97M/Eight941, W97M/Vmpck1, W97M/Verlor, and X97M/Manalo. 4 viruses except VBS/LOVELETTER are macro viruses without email functions or file destruction.
2. Release notes for May
(1) VBS/LOVELETTER
346 reports of VBS/LOVELETTER virus, which was found during long holiday week, recorded the highest number per virus kind per month (the past record was W32/Ska (Happy99) with 181 reports in March 1999.)
The number of infection report (by opening infected files) was 9 with 19 infected PCs, whereas with W32/Ska there were 132 infection reports with 253 infected PCs. 337 out of 346 reports showed no infection because they detected virus before opening the infected files. The users could avoid the damage because there were media coverage about this virus during holiday week, and users were very careful when opening their emails when they were back in the office. System administrators also took care of this virus during holiday week.
Please see http://www.ipa.go.jp/security/ for more information about VBS/LOVELETTER.
(2) Protect yourself from email virus
Recently, many kinds of email viruses such as VBS/LOVELETTER and W97M/Melissa variants have been found worldwide. In most cases the sender of the infected email is someone you know. Therefore users should be very careful when dealing with the email attachments, particularly those being sent from known people. You should always keep your anti-virus products updated, and do not execute the attachment carelessly. It is important to scan the file with a latest antivirus program, and to confirm the contents of attachments by asking the senders.
You can see a list of email viruses and brief explanation here.
(3) Number of recipient of infected files vs. actual number of infection
The following table shows the number of monthly reports and the actual number of infection reports per month. The number of damage reports has been increasing so far this year, but almost 80% (from January to May 2000) of report say they detect viruses as soon as they receive infected emails and prevent actual infection. It seems that taking some kind of anti-virus measures become popular, and as a result it keeps the infection rate very low.
For questions, please contact
Office of Computer Virus Countermeasures (OCVC)
Information-technology Promotion Agency
TEL (03) 5978-7508 FAX (03) 5978-7518 E-mail 
Computer Virus Incident Reporting System
The Ministry of International Trade and Industry announced "Computer Virus Prevention Guidelines" to prevent the spread of computer viruses in Japan. IPA was designated to receive the "Computer Virus Damage Report" directly from the infected users to investigate virus problem and to provide monthly statistics. This reporting system started in April 1990. Anyone who has encountered computer virus is supposed to send a virus report with necessary information to IPA to prevent further spread and damage of viruses.
IPA deals with each reporter (user) on an individual basis as a consultant, and also works as a public research institute for antivirus measures by analyzing problems showed on the damage report. Taking reporters' privacy into full consideration, IPA periodically publishes the result of their research and analysis on computer virus incident.
Computer Virus Prevention Guidelines:
- Enactment on April 10, 1990 (release No.139)
- Amendment on July 7, 1995 (release No. 429)
- Amendment on September 24, 1997 (release No. 535)
Prevalence Table - May 2000
There were 33 kinds of viruses reported during May. Most frequently reported viruses were VBS/LOVELETTER (346) and XM/Laroux (104). 5 kinds of new viruses, VBS/LOVELETTER, W97M/Eight941, W97M/Vmpck1, W97M/Verlor, and X97M/Manalo (marked with a "*" sign), were reported to IPA for the first time.
(Macro and Script viruses: 723 reports, Windows and DOS viruses: 177 reports)
| Macro Virus | No. of report | |
|---|---|---|
| 1 | XM/Laroux | 104 |
| 2 | W97M/Thus | 56 |
| 3 | W97M/Marker | 34 |
| 4 | W97M / X97M / P97M / Tristate | 32 |
| 5 | W97M/Ethan | 23 |
| 6 | W97M/Astia | 6 |
| 7 | W97M/Class | 6 |
| 8 | W97M/Melissa | 6 |
| 9 | X97M/Divi | 5 |
| 10 | WM/Cap | 4 |
| *11 | W97M/Eight941 | 2 |
| 12 | W97M/Myna | 2 |
| *13 | W97M/Vmpck1 | 2 |
| 14 | W97M/Chack | 1 |
| 15 | W97M/ColdApe | 1 |
| 16 | W97M/Footer | 1 |
| 17 | W97M/Groov | 1 |
| 18 | W97M/Jedi | 1 |
| 19 | W97M/Locale | 1 |
| *20 | W97M/Verlor | 1 |
| 21 | W97M/X97M/Shiver | 1 |
| *22 | X97M/Manalo | 1 |
| Script virus | No. of report | |
|---|---|---|
| *23 | VBS/LOVELETTER | 346 |
| 24 | VBS/Freelink | 45 |
| 25 | Wscript/KakWorm | 41 |
| Windows, DOS virus | No. of report | |
|---|---|---|
| 26 | W32/PrettyPark | 98 |
| 27 | W32/Ska | 46 |
| 28 | W32/CIH | 13 |
| 29 | W32/Fix2001 | 11 |
| 30 | AntiCMOS | 4 |
| 31 | Form | 3 |
| 32 | Junkie | 1 |
| 33 | Yankee_Doodle | 1 |
| Macintosh Virus | No. of report | |
|---|---|---|
| No Report | ||
Note)
In the "Name of Virus" column:
- XM stands for ExcelMacro virus that works on MSExcel 95 and 97.
- W97M stands for Word97 Macro virus that works on MSWord 97.
- W97M/X97M/P97M stands for Word97Macro/Excel97Macro/PowerPoint97Macro virus which works on MSWord 97, MSExcel 97 and MSPowerpoint 97.
- X97M stands for Excel97 Macro virus that works on MSExcel 97 WM stands for WordMacro virus that works on MSWord 95.
- W32/ stands for virus that works under Windows32.
- VBS/ stands for virus written in VisualBasicScript.
- Wscript stands for virus that works under Windows Scripting Host (WSH) excluding VBS.