This is a summary of Computer Virus Incident Reports for June 2000, compiled by IPA: Information-technology Promotion Agency (President: Shigeo Muraoka).

Total number of incident reports: 549 (900 in May: 3,290 from January to June 2000.)

[385 in June 1999, 3,645 for the year 1999 (monthly average of 304), 1,936 from January to June 1999.]
[Cumulative number of reports from April 1990 to June 2000 is 15,132]

Circumstances:

The number of incident reports decreased from 900 last month to 549 this month as the number of VBS/LOVELETTER reports declined. However, it is still the second worst record with more than 500 reports in a month.

Email was the most common source of virus with approximately 94% of total reports excluding unknown cases.

34 kinds of virus were reported in June. Most frequently reported viruses are VBS/LOVELETTER with 149 reports (346 last month). Only 14 reports (less than 10%) of total reports indicated the discovery of VBS/LOVELETTER during June and the rest (90%) were post reports of incidents from previous month. The second virus was XM/Laroux with 88 (104 last month), and W97M/Marker with 53 reports (34 last month).

4 kinds of new viruses were reported to IPA in June: VBS/Stages, VBS/Netlog, W97M/Walker and XF/Sic.

(1) Statistics of reports on first half year

Total of 3,290 reports was received between January and June 2000. 2,682 (about 82%) reports said they detected virus before infection (e.g. receiving the infected attachment files but no execution of virus occurred.) It seems that taking anti-virus measures became common practice and it resulted in a less number of actual virus infection.

• Here is the "statistics of reports on first half of the year 2000 (from January to June)" compared with the data for the year 1999 [attachment 1].

(2) VBS/Stages

VBS/Stages is a VBS(Visual Basic Script) virus found in June for the first time. This virus comes in as an attachment file with .SHS (the scrap object) extension but this extension does not appear in Windows system even if it is set to show all file extensions. You should update your anti-virus program and configure it to scan files with the SHS extension.

• More information on VBS/Stages is available at http://www.ipa.go.jp/security/topics/vbs-stages.html.(Japanese)

(3) 5 instructions when opening attachment files

Email virus with attachments has been increasing and these need to be dealt cautiously. You should be very careful when you receive suspicious emails with attachments, especially from people you know. Always keep in mind that you shouldn't execute the attachment files carelessly."

• Here is "the list of 5 instructions when opening attachment files" [attachment 2].

(4) Destruction caused by careless download

IPA receives many queries from troubled users who are anxious about possibility of virus infection caused by programs they downloaded from the internet websites. If these programs happen to be malicious ones and you automatically execute them, they can cause various problems such as deleting files on your hard drive. In most cases they are not exactly viruses and there is high possibility that anti-virus program will not detect them. It is not completely safe even though your anti-virus programs don't report any virus. You should not download programs except the ones from trusted sites, and should also need to act on your own responsibility to avoid problems.

• Here is the information on "Much destruction caused by careless download" which describes how to avoid troubles when downloading programs from websites [attachment 3].

Office of Computer Virus Countermeasures (OCVC)
Information-technology Promotion Agency
TEL: (03) 5978-7508 FAX: (03) 5978-7518 E-mail:

There were 34 kinds of viruses reported during June. Most frequently reported viruses were VBS/LOVELETTER (149) and XM/Laroux (88). 4 kinds of new viruses, VBS/Stages, VBS/Netlog, W97M/Walker, and XF/Sic (marked with a "*" sign) were reported to IPA for the first time.
(Macro and Script viruses: 454 reports, Windows and DOS viruses: 95 reports)

Macro Virus	No. of report
XM/Laroux	88
W97M/Marker	53
W97M/Ethan	25
W97M/Class	15
W97M/Thus	15
W97M/X97M/ P97M/Tristate	12
X97M/Divi	10
W97M/Walker (*)	9
W97M/Melissa	6
XM/VCX.A	5
W97M/Locale	3
W97M/Myna	3
W97M/Chack	2
W97M/Eight941	2
W97M/Vmpck1	2
W97M/Astia	1
W97M/Jedi	1
W97M/Nono	1
W97M/Opey	1
W97M/story	1
WM/Cap	1
XM/Extras	1
XF/Sic (*)	1

Windows, DOS virus	No. of report
W32/Ska	51
W32/PrettyPark	24
W32/Fix2001	11
AntiCMOS	4
W32/CIH	2
W32/Marburg	1

Script virus	No. of report
VBS/LOVELETTER	149
Wscript/KakWorm	31
VBS/Stages (*)	11
VBS/Netlog (*)	5

Macintosh Virus	No. of report
Autostart9805	2

Note) The abbreviation used in the "Name of Virus" are as follows:

• XM and XF: ExcelMacro and ExcelFormula virus that works on MSExcel 95 and 97.
• W97M: Word97 Macro virus that works on MSWord 97.
• W97M/X97M/P97M: Word97Macro/Excel97Macro/PowerPoint97Macro virus which works on MSWord 97, MSExcel 97 and MSPowerpoint 97.
• X97M: Excel97 Macro virus that works on MSExcel 97
• WM: WordMacro virus that works on MSWord 95.
• W32: virus that works under Windows32.
• VBS: virus written in VisualBasicScript.
• Wscript: virus that works under Windows Scripting Host (WSH) excluding VBS.

• Computer Virus Incident Reports for June, 2000(full report)