IT Security Center

Activities

Information Service Activities

Security Software Development Activities

CRYPTREC

IT SecurityAssurance

Organization

PGP key

RFCs

Mission Statement

Links

About IPA/ISEC

Japanese

IPA TOP>IT Security Center Japanese TOP>IT Security Center English TOP>information

January 10, 2003
 Information-technology Promotion Agency
Security Center (IPA/ISEC)

The worst virus ever !
There were approximately 10,000 reports for W32/Klez in one year !!

1. Computer Virus Incident Reports

This is a  Computer Virus Incident Reports for December 2002 and for the year 2002 compiled by IPA: Information-technology Promotion Agency.

1-1. Annual virus incident report for 2002 -- W32/Klez had the worst number of reports ever --

In 2002, 20,352 reports were submitted to IPA, and the number decreased slightly compared from 2001 having 24,261 reports.
W32/Klez had the worst number reported for 9 consecutive months, having 9,648 reports (approximately 50% of total), which made a single virus to have the worst number of reports ever for a year. This was followed by W32/Badtrans having 3,336 reports and W32/Hybris having 870 reports. 



For more information, please refer to "Computer Virus Detection Incident Reports in 2002"

1-2. December computer virus incident reports

In December, 1,135 reports were submitted to IPA (November: 1,408 reports). The top number of viruses reported were W32/Klez having 465 reports with new variants having subjects such as "Happy Christmas" and "Happy New year", W32/Bugbear having 133 reports, and W32/Opaserv and VBS/Redlof, having 67 reports.

In addition, an alert was announced for a massive spread of virus mail during the year change period since there was a concern, but there was no serious viral damage.

Caution necessary for infection through web page !!

There are viruses, such as VBS/Redlof, where infection is obtained just by browsing a web page. When infected with this virus, infection is spread through ways provided below. 

 *Infected computer will record the virus program in the body of the sending e-mail, hence spreads the infection. 

 *Infects HTML and other files on the computer, and when the infected file is uploaded on the web page without noticing this, infection will spread to people who browse the web page. 

Especially, there are more cases where one gets infected through browsing a web page, so caution is necessary.

2. Warning for this month : 
  Start virus countermeasure from anti-virus software !!
   ===== In order to use the internet comfortably ! =====

There are various ways for virus infection to happen. The most common type is obtained through attached file on the e-mail, such as W32/Klez and W32/Bugbear. But there are infections obtained from browsing a web page, such as W32/Nimda and VBS/Redlof, and infections obtained from shared network, such as W32/Opaserv.

In order to prevent infection damages through various paths from happening, it is essential to use the anti-virus software with the latest version of virus detecting data file on a constant monitoring setting.

	3 steps for anti virus software
	1. Must be installed		=== Necessity for countermeasure
	2. Appropriate setting		=== Constant monitoring setting is effective
	3. Updating virus detecting data file		=== New virus emerges everyday Update at least once a week !

3. Prevalence Table .

1) There were 47 kinds of viruses reported in December. (998 reports for Windows/DOS, 136 reports for Macro and Script virus, 3 for Macintosh and UNIX virus.)

(*) indicates new virus in this month.

Note: the numbers of reports include reported modified variants

Note: The abbreviation used in the "Name of Virus" are as follows:

2) The following table shows the number of reports sorted by reporting body. Most reports came from "general corporate user" with about 87% of total reports.

3) The following table shows the number of reports sorted by region. The largest number of reports was from Kanto region, followed by Kinki and Chubu region.

4) The following table shows the source of virus by damage reports. The most common case is that being infected by mails including from overseas. The share is 92% among numbers of reporting

(*) including Web page infection

5) The following table shows the number of PCs infected by viruses.

4. Virus Payload Dates

To prevent the spread of virus, please check the special notice on viruses that have payload dates between January 10 and February 28.

For more information, please refer to the virus calendar at: 
http://www.ipa.go.jp/security/virus/viruscalendar.html (Japanese)

=W32/Klez (It occurs data 6th every month)
On 6th February, the files in C drive will be destroyed.

= VBS/Haptime (It occurs when the total of month and date is 13)
On January 12 and February 11, the files of which extension is .dll, .exe will be deleted.