This is a summary of Computer Virus Incident Reports for August 2000, compiled by IPA: Information-technology Promotion Agency (President: Shigeo Muraoka).

Total number of incident reports:

556 (700 in July: 4,546 from January to August 2000.)

[216 in August 1999, 3,645 in the year 1999 (monthly average of 304), 2,451 from January to August 1999.]
[Cumulative number of reports from April 1990 to August 2000 is 16,388]

Circumstances:

Only about 10% (59 reports) out of 556 total reports this month showed the actual infection. Email was the most common source of virus with approximately 90% of total reports.

38 kinds of virus were reported in August. There was no outstanding number of reports such as VBS/LOVELETTER in May or VBS/Stages in July. There were 5 viruses with more than 50 reports: VBS/LOVELETTER (84 reports), XM/Laroux (83), VBS/Stages (64), Wscript/Kakworm (54), and W32/Ska (52). The number of these reports is almost even, so taking basic anti-virus measures becomes more important as ever.

4 kinds of new viruses were reported to IPA in August: X97M/Barisada, W97M/Assilem, W97M/Newhope and W97M/Nsi.

(1) Be careful not only about email virus, but also macro viruses.
There still are many reports of email viruses this year such as VBS/LOVELETTER and VBS/Stages [289 reports (52% of total reports)]. These type of script virus draw the attention of users, but you should not forget about Excel and Word macro virus [262 reports (47% of total reports)]. All new viruses reported this month were macro viruses, and XM/Laourx, which infects Excel documents and had second most reports this month, is most popular virus since 1999. It is quite common these days to exchange Excel or Word document as an email attachment file in routine work, but these files might be infected by macro viruses. You should not neglect macro virus protection.

Total number of both email virus and macro virus report (including 6 reports of W97M/Melissa) accounted for 98% of all reports in August. 2% is for W32/CIH, AntiCMOS, Form, D3, SAMPO, Stoned and MBDF. This means that you can avoid infection by most popular virus if you have proper anti-virus measures against these viruses.

89% of total reports said they found virus before executing them, therefore they could avoid actual virus infection. This means prevention of virus infection is possible by using appropriate anti-virus measures. You should continue to keep basic anti-virus rules and policies.

Basic anti-virus measures

Once you get infected by virus, you might encounter various unexpected problem such as spreading virus unknowingly to others, or not being able to access CD-ROM drives or printer etc. Therefore you should use anti-virus products continuously.

Please refer to the following URL and take basic anti-virus measures appropriately such as updating virus pattern files of your anti-virus products regularly.

• 7 basic anti-virus measures for PC users
  http://www.ipa.go.jp/security/english/virus/antivirus/E_7kajo.html
• The list of 5 instructions when opening attachment files
  http://www.ipa.go.jp/security/english/virus/press/200007/E_attach52.html

Also, IPA continuously receives many inquiries from users who downloaded unknown program, executed it and got into trouble. You should pay attention to your own safety to avoid these problems.

• Destruction Caused by Careless Download
  http://www.ipa.go.jp/security/english/virus/press/200007/E_malicious2.html

For questions, please contact:

Office of Computer Virus Countermeasures (OCVC)
Information-technology Promotion Agency
TEL: (03) 5978-7508 FAX: (03) 5978-7518 E-mail:

Prevalence Table - August 2000

There were 38 kinds of viruses reported during August. Most frequently reported viruses were VBS/LOVELETTER (84) and XM/Laroux (83). 4 kinds of new viruses, X97M/Barisada, W97M/Assilem, W97M/Newhope and W97M/Nsi (marked with a "*" sign) were reported to IPA for the first time (Macro and Script viruses: 465 reports, Windows and DOS viruses: 91 reports)

Note) The abbreviation used in the "Name of Virus" are as follows:
XM and XF: ExcelMacro and ExcelFormula virus that works on MSExcel 95 and 97.
W97M: Word97 Macro virus that works on MSWord 97.
W97M/X97M/P97M: Word97Macro/Excel97Macro/PowerPoint97Macro virus which works on MSWord 97, MSExcel 97 and MSPowerpoint 97.
X97M: Excel97 Macro virus that works on MSExcel 97.
WM: WordMacro virus that works on MSWord 95.
W32: virus that works under Windows32.
VBS: virus written in VisualBasicScript.
Wscript: virus that works under Windows Scripting Host (WSH) excluding VBS.

Computer Virus Incident Reports for August, 2000(full report)