Trend Virus Report - April 2001 Issue # 1

************************************************************************
V I R U S R E P O R T
    
(by the Trend Micro US Virus Research Group)
************************************************************************
------------------------------------------------------------------------
Date: 04.06.2001 Issue Number: 04/01
------------------------------------------------------------------------
    
To read an HTML version of this newsletter, go to:
http://www.antivirus.com/trendsetter/virus_report/
  
If you're a corporate user and want to assess your virus protection,
check out Trend's Virus Risk Assessment Web site at:
http://www.antivirus.com/free_tools/edoctor/
    
Issue Preview:
    
1. TREND UPDATES: Pattern File and Scan Engine Update
2. Roaring About Linux -- ELF_LION.A
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend US
4. Top 10 Viruses Trend US Customers are Most Concerned About
5. HTML Email -- A New Threat
6. Desktop Antivirus with a Personal Firewall
  
NOTE: Long URLs may break into two lines in some mail readers.
Cut and paste, should this occur.
  
************************************************************************
    
1. TREND UPDATES: Scan Engine and Pattern File Updates
------------------------------------------------------------------------
PATTERN FILE: 873 http://www.antivirus.com/download/pattern.asp
SCAN ENGINE: 5.300 http://www.antivirus.com/download/engines/
  
2. Roaring About Linux -- ELF_LION.A
------------------------------------------------------------------------
Recently there have been several new malicious programs that infect vulnerable
Linux systems. ELF_LION.A is one such Internet worm. Upon execution,
it connects to a Web site and downloads a file. It gathers
certain information from the infected system and sends the information
to a specific email address.
 
For additional information about ELF_LION please refer to our Web site at:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=ELF_LION.A
 
ELF_LION.A is detected with Trend pattern #867 and above.
 
3. 10 Most Prevalent In-The-Wild Malware Surveyed by Trend US
(week of: 03/26/2001 to 04/01/2001)
------------------------------------------------------------------------
1. TROJ_MTX.A
2. TROJ_HYBRIS.B
3. VBS_KAKWORM.A
4. PE_MTX.A
5. TROJ_BYMER
6. JS_SEEKER.E
7. PE_MAGISTR.A
8. JS_LOGO.A
9. ONEHALF.3455
10. TROJ_HYBRIS.DLL
 
SPECIAL OFFER:
Webmasters, add free virus information updates to your Web site with our Virus Info Feed.
Simply copy and paste a small piece of code to give your visitors a real-time
top 10 list and the latest virus advisories. Setup takes about 10 minutes
and requires no server-side code on your Web site. All content is updated
automatically from Trend Micro's Web site.
http://www.antivirus.com/syndication/vinfo/default.asp?ref=nwsltr
  
4. Top 10 Viruses Trend US Customers are Most Concerned About
   (where systems were not infected)
------------------------------------------------------------------------
1. VBS_KAKWORM.A
2. TROJ_MTX.A
3. TROJ_HYBRIS.B
4. TROJ_SKA.WSOCK32
5. TROJ_BYMER
6. PE_MAGISTR.A
7. VBS_KAKWORM.A-M
8. TROJ_SUB7.22.B
9. TROJ_IGMNUKE
10. TROJ_HYBRIS.DLL
 
5. HTML Email -- A New Threat
------------------------------------------------------------------------
Since HTML emails are simply Web pages, IE can render them and open binary
attachments in a way that is appropriate to their MIME types. However, if
the MIME header information is modified in a certain way, IE automatically launches an
email attachment that comes with the HTML email automatically, without the user
ever clicking on the attachment. This vulnerability could be used by attackers to
send infected HTML pages via email or the infected HTML could be hosted on
a Web site causing every visitor to open the infected attachment automatically.
 
Trend pattern #872 offers detection for demonstration files that use this particular exploit.
For additional information, please refer to:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_IE_XPLOIT.A
 
You can also download a patch for this at the Microsoft Web site:
http://www.microsoft.com/windows/ie/download/critical/Q290108/
 
6. DESKTOP ANTIVIRUS WITH A PERSONAL FIREWALL
------------------------------------------------------------------------
Buy Trend Micro PC-cillin 2000 and get ZoneLabs ZoneAlarm Pro for the bargain
price of $19.99. PC-cillin is one of the best desktop antivirus products in the market
and ZoneAlarm provides state-of-the-art personal firewall protection.
Buy your copy today at:
http://www.antivirus.com/trendsetter/virus_report/digital_river.htm
PRICE AND BUNDLE ONLY AVAILABLE IN NORTH AMERICA.

************************************************************************
You are receiving this email from Trend Micro, because you have either
downloaded a Trend product or have signed up for our "Weekly Virus
Report." If you would like to change the way you receive email from
Trend, please make changes in your account page at
http://www.antivirus.com/subscriptions/default.asp?email=trendmicro_pattern@netzwerk-aktiv.com
 
To UNSUBSCRIBE go to:
http://www.antivirus.com/subscriptions/default.asp?format=unsubscribe
 
For questions regarding viruses, please contact the Virus Doctor at
Virus_Doctor@trendmicro.com.
 
For questions regarding products, please contact Tech Support at
support@trendmicro.com.
 
For questions, comments and suggestions about the Weekly Virus Report
please contact our editor at Newsletters@trendmicro.com.
************************************************************************
Received on Fri, 6 Apr 2001 11:53:10 -0700