Trend Micro Virus Report - August 2001 Issue # 3

************************************************************************
V I R U S R E P O R T
    
(by the Trend Micro US Virus Research Group)
************************************************************************
------------------------------------------------------------------------
Date: August 17, 2001 Issue Number: 08/03
------------------------------------------------------------------------
 
To read an HTML version of this newsletter, go to:
http://www.antivirus.com/trendsetter/virus_report/
 
If you're a corporate user and want to assess your virus protection,
check out Trend Micro's Virus Risk Assessment Web site at:
http://www.antivirus.com/free_tools/edoctor/
 
Issue Preview:
 
1. TREND MICRO UPDATES: Pattern File and Scan Engine Updates
2. Propagating via MSN Messenger -- TROJ_NEWPIC.A
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
4. Top 10 Viruses Trend Micro's US Customers are Most Concerned About
5. Just Another New Trojan -- TROJ_MODNAR.A
6. Test Your Virus Knowledge & Scan Your Computer FREE!
 
NOTE: Long URLs may break into two lines in some mail readers.
Should this occur, please cut and paste the URL in your browser.
 
************************************************************************
 
1. TREND MICRO UPDATES: Pattern File and Scan Engine Updates
------------------------------------------------------------------------
PATTERN FILE: 925 http://www.antivirus.com/download/pattern.asp
SCAN ENGINE: 5.450 http://www.antivirus.com/download/engines/
  
2. Propagating via MSN Messenger -- TROJ_NEWPIC.A
------------------------------------------------------------------------
TROJ_NEWPIC.A is a non-destructive worm written in Visual Basic 6.0. It
propagates via MSN messenger by sending copies of itself to users in an
infected user's contact list. This worm creates and drops a file, 1README.TXT
and after infection appears in the Task Manager as a process "MsgSprd." Upon
execution, it displays the following error message:
" Cannot open file. May be corupted. Replace the file with a new one
and try again. "
 
For more information about TROJ_NEWPIC.A, visit Trend Micro at:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_NEWPIC.A
 
TROJ_NEWPIC.A is detected by Trend Micro pattern file #924.
 
3. 10 Most Prevalent In-The-Wild Malware Surveyed by Trend Micro US
(week of: August 6, 2001 to August 12, 2001)
------------------------------------------------------------------------
1. TROJ_SIRCAM.A
2. VBS_HAPTIME.A
3. PE_MAGISTR.A
4. TROJ_CODERED.C
5. JS_KAKWORM.A
6. TROJ_BADTRANS.A
7. TROJ_MTX.A
8. TROJ_CHOKE.A
9. PE_MAGISTR.DAM
10. TROJ_BYMER
 
SPECIAL OFFER:
Webmasters, add free virus information updates to your Web site with our Virus
Info Feed. Simply copy and paste a small piece of code to give your visitors a
real-time top 10 list and the latest virus advisories. Setup takes approximately
10 minutes and requires no server-side code on your Web site. All content is
updated automatically from Trend Micro's Web site. http://www.antivirus.com/syndication/vinfo/default.asp?ref=nwsltr
 
4. Top 10 Viruses Trend Micro's US Customers are Most Concerned About
(where systems were not infected)
------------------------------------------------------------------------
1. TROJ_SIRCAM.A
2. JS_KAKWORM.A
3. PE_MAGISTR.A
4. VBS_HAPTIME.A
5. PE_FUNLOVE.4099
6. JS_KAKWORM.B
7. CODERED.C
8. W97M_MARKER.BO
9. TROJ_FUNSO.A
10. PERL_SADMIND.A
 
5. Just Another New Trojan -- TROJ_MODNAR.A
------------------------------------------------------------------------
TROJ_MODNAR.A is a non-destructive Win32 worm, which propagates via email using
the default mail client of the infected computer. It randomly generates the
subject, message body, and attachment of the email it sends. The subject and
message body always end with both a punctuation mark and a question mark(!?).
This worm is coded in Visual C/C++. Some of its variants are UPX compressed.
 
For more information about TROJ_MODNAR.A, visit Trend Micro at:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_MODNAR.A
 
TROJ_MODNAR.A is detected by Trend Micro pattern file #920.
 
6. Test Your Virus Knowledge & Scan Your Computer FREE!
------------------------------------------------------------------------
Do you think you know enough about viruses? Try our new HouseCall quiz as
you scan your computer FREE for viruses and other malicious code. At the end
of the quiz you may be lucky to get Trend Micro PC-cillin 2000 for 10%, 15%, or
20% OFF!!
 
SCAN NOW at http://housecall.antivirus.com

************************************************************************
You are receiving this email from Trend Micro, because you have either
downloaded a Trend Micro product or have signed up for our "Weekly Virus
Report." If you would like to change the way you receive email from
Trend Micro, please make changes in your account page at
http://www.antivirus.com/subscriptions/default.asp?email=trendmicro_pattern@netzwerk-aktiv.com
 
To UNSUBSCRIBE go to:
http://www.antivirus.com/subscriptions/default.asp?format=unsubscribe
 
For questions regarding viruses, please contact the Virus Doctor at
Virus_Doctor@trendmicro.com.
 
For questions regarding products, please contact Tech Support at
support@trendmicro.com.
 
For questions, comments and suggestions about the Weekly Virus Report
please contact our editor at Newsletters@trendmicro.com.
************************************************************************
Received on Fri, 17 Aug 2001 15:18:31 -0700