August 4, 2000

ISEC
Information-technology Promotion Agency

Computer Virus Incident Reports (abstract)

1. Computer Virus Incident Reports for July, 2000

This is a summary of Computer Virus Incident Reports for July 2000, compiled by IPA: Information-technology Promotion Agency (President: Shigeo Muraoka).

• Total number of incident reports: 700 (549 in June: 3,990 from January to July 2000.)

  [299 in July 1999, 3,645 for the year 1999 (monthly average of 304), 2,235 from January to July 1999.]
  [Cumulative number of reports from April 1990 to June 2000 is 15,832]

• Circumstances:

  This month recorded the second highest number of incident reports per month. The highest was May 2000 with 900 reports. 246 reports of VBS/Stages was also the second highest number per month (the highest was 346 reports of VBS/LOVELETTER in May 2000.) Cumulative number of reports from January to July 2000 has already exceeded the number of total reports for the year 1999 and continues to set another highest record for the year 2000.
  
  Email was the most common source of virus with approximately 97% of total reports excluding unknown cases.
  
  38 kinds of virus were reported in July. Most frequently reported viruses are VBS/Stages with 246 reports (11 last month), followed by XM/Laroux with 66 reports (88 last month) and Wscript/Kakworm with 57 reports (31 last month).
  
  4 kinds of new viruses were reported to IPA in July: W97M/Smac, W97M/Proverb, W97M/Claud and W97M/JulyKiller.

2. Release notes for July

(1) Drastic increase of VBS/Stages reports
VBS/Stages, which was first reported in June, increased rapidly from 11 reports last month to 246 this month. VBS/Stages is a VBS (Visual Basic Script) virus that spreads via email. This virus comes in as an attachment file with .SHS (the scrap object) extension but this extension does not appear in Windows system even if it is set to show all file extensions. VBS/Stages uses MS Outlook to send itself as an attachment to addresses registered in the address book. You should be careful with emails with attachment sent from someone you know. Do not open the attachment files carelessly.

More information on VBS/Stages is available at http://www.ipa.go.jp/security/topics/vbs-stages_alert.html. Information on all viruses reported to IPA is available at IPA virus data base: http://www.ipa.go.jp/cgi-bin/security/virus/search/(Japanese)

(2) Growing number of Email virus; Highest number of annual reports; Decrease in number of actual infection
Cumulative number of reports from January to July 2000 (3,990) has exceeded the number of total reports for the year 1999 (3,645) and continues to set another highest record for the year 2000. However, the number of actual damage reports caused by infection is decreasing by more than 50% (cumulative number from January to July is 690 in 2000 and 1417 in 1999.) There is a remarkable growth in the number of email virus. As a source of virus, email (both domestic and international) is increasing with 40.6% in 1998, 67.0% in 1999 and 86.0% in first half of 2000. This type of virus abuses the email system and propagates very quickly and widely. You should take enough caution when opening the attached files to prevent infection. Please refer to "the list of 5 instructions when opening attachment files" at http://www.ipa.go.jp/security/english/virus/press/200007/E_attach52.html.

(3) Unsafe web sites
Recently IPA often receives queries about web sites that display virus-like messages or about strange programs that act like virus. The following describes some typical examples:

1) When a user visited a site, the message was displayed on the screen; "Your machine is infected by virus." "You need to execute this program to restore your machine." The user downloaded the program and executed it, and the machine had been malfunctioning since then.

2) A user received an email with signature from a friend. Upon clicking an URL contained in the signature part, it automatically started downloading and saving an unknown file in the directory. After executing this file, an URL of a specific web site is added in the user's signature of all outgoing emails.

We found out that these cases were not caused by virus. However, you should not execute downloaded programs without through check to avoid these problems.
Please refer to "Destruction Caused by Careless Download" at
http://www.ipa.go.jp/security/english/virus/press/200007/E_malicious2.html

For questions, please contact:
Office of Computer Virus Countermeasures (OCVC)
Information-technology Promotion Agency
TEL: (03) 5978-7508 FAX: (03) 5978-7518 E-mail: isec-info@ipa.go.jp

Prevalence Table - July 2000

There were 38 kinds of viruses reported during July. Most frequently reported viruses were VBS/Stages (246) and XM/Laroux (66). 4 kinds of new viruses, W97M/Smac, W97M/Proverb, W97M/Claud and W97M/JulyKiller (marked with a "*" sign) were reported to IPA for the first time. (Macro and Script viruses: 593 reports, Windows and DOS viruses: 107 reports)

Note) The abbreviation used in the "Name of Virus" are as follows:
XM and XF: ExcelMacro and ExcelFormula virus that works on MSExcel 95 and 97.
W97M: Word97 Macro virus that works on MSWord 97.
W97M/X97M/P97M: Word97Macro/Excel97Macro/PowerPoint97Macro virus which works on MSWord 97, MSExcel 97 and MSPowerpoint 97.
X97M: Excel97 Macro virus that works on MSExcel 97
WM: WordMacro virus that works on MSWord 95.
W32: virus that works under Windows32.
VBS: virus written in VisualBasicScript.
Wscript: virus that works under Windows Scripting Host (WSH) excluding VBS.

Computer Virus Incident Reports for July, 2000(full report)