November 9, 2000
Information-technology Promotion Agency

　Computer Virus Incident Reports

1. Computer Virus Incident Reports of October, 2000

This is a summary of Computer Virus Incident Reports of October 2000, compiled by IPA: Information-technology Promotion Agency (President: Shigeo Muraoka).

• Total number of incident reports was record high of 906 (676 last month: 6,128 from January to October 2000.)

[405 in October 1999, 3,645 in the year 1999 (monthly average of 304), 3,188 from January to October 1999.]
[Cumulative number of reports from April 1990 to October 2000 is 17,970]

• Circumstances:

906, this month's number of incidents, is the highest record. As for reporting body, the reports from individual user suddenly increased to 11% of the total. Email was the most common source of virus with approximately 94% of the total. 44 kinds of virus were reported in October. 4 kinds of new viruses were reported: W32/Kriz, VBS/NewLove, W97M/Titch, and W97M/Turn.

2. Release notes for October

(1) Highest record of virus incidents this month, worse than VBS/LOVELETTER
906 became the worst record in the past, followed by 900 in May 2000 when VBS/LOVELETTER caused many damage. Besides, the actual infection reports show 30% of the total (it was 13% last month) and the damage is becoming more serious.

(2) The drastic increase of "W32/MTX" infection that destroys PC
W32/MTX is widely spreading. This virus uses attached files with 31 different names and destroys PC upon execution. Among the names of attachment files, those of known virus (such as LOVELETTER Virus) are included and it is very confusing (see the list of attachment files).

W32/MTX was reported last month for the first time, and there were already 223 reports this month. The report of actual infection was 111, almost half of the total report which is very high infection rate. W32/MTX propagates by sending out a copy of itself to whoever the infected user sends an email to as the second mail. When the receivers see this second mail from the same sender, they automatically open the infected attachment without a doubt. Because of that this virus easily spreads among friends and acquaintances. Once infected, you should format the hard disk and reinstall Windows to make sure the complete recovery and disinfection of this virus. Therefore the damage caused by W32/MTX is very serious.

Information on new virus "W32/MTX"
http://www.ipa.go.jp/security/topics/mtx.html (Japanese)

(3) Be careful about "W32/QAZ" that may lead to unauthorized access
Reportedly, W32/QAZ was used in Microsoft hacking incident. The number of this virus is suddenly increasing and you should take enough caution. This is a Trojan Horse that has backdoor capabilities such as stealing IP addresses and making remote access possible. This doesn't have automatic email-sending function, but people with malicious intention will attach this trojan as an attached file and send them intentionally. You should not open the attachment file sent from unknown people. There was 1 report of W32/QAZ first time in the last month, but this month we received 34 reports.

Be careful about W32/QAZ that is reportedly used in the hacking incident.
http://www.ipa.go.jp/security/topics/qaz.html (Japanese)

3. Special announcement for this month

Providing is preventing: use "Anti-virus Check List" to avoid infection

Among inquiries from infected uses, we found that a great number of users don't know the very basics of how to use the anti-virus program. They don't know whether the anti-virus software is installed or not in their own PCs, they don't realize the importance of updating the program, or they don't know hot to use the anti-virus program.

To have virus free PC life, we made the "Anti-virus Check List" that describes the fundamental items that the users should know. It is important to take necessary steps and realize what you need to avoid virus infections.

Anti-virus Check List
http://www.ipa.go.jp/security/virus/beginner/check/check1.html(Japanese)

For questions, please contact:
Office of Computer Virus Countermeasures (OCVC)
Information-technology Promotion Agency
TEL: (03) 5978-7508
FAX: (03) 5978-7518
E-mail: isec-info@ipa.go.jp
Virus Emergency Call: (03) 5978-7509
URL: http://www.ipa.go.jp/security/

Prevalence Table - October 2000

There were 44 kinds of viruses reported during October. Frequently reported viruses were W32/MTX (223 reports) and VBS/LOVELETTER (128 reports). 4 kinds of new viruses, W32/Kriz, VBS/NewLove, W97M/Titch, and W97M/Turn (marked with a "*" sign) were reported to IPA for the first time (Macro and Script viruses: 543 reports, Windows and DOS viruses: 370 reports, Mac virus: 1 report). Some reports contain multiple infection, therefore the sum total doesn't match with 906 (total number of October report).

Note)
The abbreviation used in the "Name of Virus" are as follows:

The following table shows the name and developer/distributor of antivirus products that are used for detection and disinfection in October.

3. Outline of October report

(1) The following are brief descriptions of viruses that are reported to IPA for the first time in October:

W32/Kriz

W32/Kriz propagates under Win32 system. It infects Win32 executable exe files (PE exe files with the extension ".exe" or ".scr"). When an infected file is run, the virus creates the copy of "Kernel32.dll" in the Windows system directory and renames it to "Krized.tt6". Then it modifies "Wininit.ini" so that "Kernel32.dll" is overwritten with "Krized.tt6" on the next reboot. It becomes memory resident and infects to every file that is run or copied. The payload of this virus is activated on December 25th when an infected file is run while the virus stays in a memory. W32/Kriz damages CMOS memory and destroy all hard drives by overwriting them with garbage. It may destroy Flash BIOS depending of the machine types.

VBS/NewLove (VisualBasicScript/NewLove)

VBS/NewLove propagates as an email attachment file. When the virus is run, it copies itself to Windows folder (usually C:\Windows) and Windows system folder (usually C:\Windows\System). The name of this file is randomly chosen from the recently opened files directory. The extension is taken from the following list:

Doc.Vbs, Xls.Vbs, Mdb.Vbs, Bmp.Vbs, Mp3.Vbs, Txt.Vbs, Jpg.Vbs, Gif.Vbs, Bov.Vbs, Url.Vbs, Htm.Vbs

Then the virus modifies registry so that the virus is run automatically upon next reboot. When Microsoft Outlook is installed, the virus sends the following email to each recipient in Outlook address book.

Subject: FW: [ramdom file name (excluding the file extension) that virus created in Windows]
Body: [empty]
Attachment file: [ramdom file name that virus created in Windows].vbs

Finally, the virus changes the length of all files on all hard drives (excluding the currently used files, system attribute or read-only files) to 0 byte, and change the extention to .VBS (e.g.: xxxx.jpg=xxxx.jpg.vbs).

W97M/Titch (Word97Macro/Titch)

W97M/Titch propagates under Microsoft Word (MSWord). This virus infects MSWord when an infected document is opened. Every document that is created or modified on infected MSWord thereafter becomes infected when the document is closed. Once infected, the "Macro Virus Protection" option in "Tools/Options/General" will be turned off. There is no payload. This virus works under Japanese version of MSWord97/98/2000 and English version of MSWord97/2000.

W97M/Turn

W97M/Turn propagates under Microsoft Word (MSWord). This virus infects MSWord when an infected document is opened. Every document that is created or modified on infected MSWord thereafter becomes infected when the document is closed. Once infected, the "Macro Virus Protection" option in "Tools/Options/General" will be turned off. It also disables VisualBasicEditor. There is no payload. This virus works under Japanese version of MSWord97/98/2000 and English version of MSWord97/2000.

(2) The following table shows the number of reports sorted by reporting body. Most reports came from "general corporate uses" with about 87% of total reports.

(3) The following table shows the number of reports sorted by region. The largest number of reports was from Kanto region, followed by Chubu and Kinki region.

(4) The following table shows the source of virus. Approximately 86% of total reports said email (including oversea emails) was the most common source.

(5) The following table shows the number of PCs infected by viruses. 0 machine indicates that the virus was found either on floppy disks or in a document and was detected before infection occurred.

VIRUS PAYLOAD DATES

To prevent the spread of virus, below is a special notice on viruses that have payload dates between November 6 and December 31. For more information, please refer to the virus calendar at

You should detect and clean virus with updated antivirus software before its payload is triggered, since the disinfection and recovery afterwards could be very difficult (such as losing data etc.)

• W97M/Class (Word97Macro/Class) November 14th, December 14th

• Wscript/Kakworm (WindowsScript/Kakworm) December 1st