Trend Micro Weekly Virus Report - December 2001 Issue #3

************************************************************************
V I R U S R E P O R T
    
(by the Trend Micro US Virus Research Group)
************************************************************************
------------------------------------------------------------------------
Date: December 21, 2001
------------------------------------------------------------------------
If you're a corporate user and want to assess your virus protection,
check out Trend Micro's Virus Risk Assessment Web site at:
http://www.antivirus.com/free_tools/edoctor/

Issue Preview:

1. TREND MICRO UPDATES: Pattern File and Scan Engine Updates
2. Wishing You a Happy New Year - WORM_MALDAL.C (Low Risk)
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
4. ATTENTION PC-CILLIN USERS: Urgent Virus Protection Alert

NOTE: Long URLs may break into two lines in some mail readers.
Should this occur, please cut and paste the URL in your browser.

************************************************************************

1. TREND MICRO UPDATES: Pattern File and Scan Engine Updates
------------------------------------------------------------------------
PATTERN FILE: 187 or 987 http://www.antivirus.com/download/pattern.asp
SCAN ENGINE: 5.630 http://www.antivirus.com/download/engines/

2. Wishing You a Happy New Year -- WORM_MALDAL.C (Low Risk)
------------------------------------------------------------------------
WORM_MALDAL.C is a destructive, memory-resident worm. It is a Visual
Basic-compiled Windows executable that propagates via email using Microsoft
Outlook and upon execution deletes any files with the extensions: .DLL, .DRV,
.VXD, and .TSP in the System directory. A sample of the email it arrives in
is as follows:

Subject: Happy New Year
Message Body: Hii
I can’t describe my feelings
But all i can say is
Happy New Year :)
Bye
Attachment: CHRISTMAS.EXE

For additional information about WORM_MALDAL.C, please visit Trend Micro
at: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_MALDAL.C.

WORM_MALDAL.C is detected by Trend Micro pattern file #186 or #986.

3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
(week of: December 10, 2001 to December 16, 2001)
------------------------------------------------------------------------
1. WORM_BADTRANS.B
2. PE_MAGISTR.B
3. PE_MAGISTR.A
4. WORM_SIRCAM.A
5. WORM_GONE.A
6. JS_PLAY.A
7. VBS_HAPTIME.A
8. JS_EXCEPTION.GEN
9. DIABLO_BOOT
10. TROJ_NEWPIC.A

4. ATTENTION PC-CILLIN USERS: Urgent Virus Protection Alert
------------------------------------------------------------------------
To ensure you have the most up-to-date protection during the high risk
holiday season, it is important for you to check your PC-cillin 2000 software
to make sure that it is using the latest virus protection databases from
Trend Micro.
 
The latest virus protection databases from Trend Micro, also known as "pattern
files," have three digits and begin with the number "1" (i.e. 181). As of the
date of this email, the latest pattern files are approaching number 188. Trend
Micro began using these new 100-series pattern files several months ago. Under
the previous system, pattern files were identified by numbers in the 900s (i.e. 981).
 
It is important for you to check your copy of PC-cillin and make sure it is
using a pattern file numbering in the 100s. Copies of PC-cillin that still
use pattern files numbering in the 900s will not be able to deploy the latest
virus protection updates from Trend Micro once the pattern files reach 999,
which will occur very soon.
 
To make sure you are receiving, and can continue to receive, the most current
virus protection from Trend Micro, please follow these simple verification
instructions:

VERIFICATION PROCEDURES
 
1. Click the Windows Start button in the bottom left hand corner of your
screen, then choose Programs > Trend PC-cillin 2000 > Trend PC-cillin 2000
to open the PC-cillin 2000 program.
2. From the main menu, click Help > About.
3. In the "About PC-cillin" dialog box that appears, "Scan Engine" should be
5.50 or later, and "Pattern number" should be 165 or later.
 
If your pattern file number is in the 100s, your virus protection is current.
You need do nothing more to ensure the most effective operation of PC-cillin.
 
If your pattern files number is in the 900s, go to:
http://pc-cillin.com/900ptn for instructions on how to upgrade your PC-cillin
software to the latest virus protection database. This jump site will provide
you with a special telephone number to call if you have any further questions
about, or problems with, the upgrade instructions.
  
Thanks for your attention to this matter.
Happy holidays,
PC-cillin Technical Support

************************************************************************
You are receiving this email from Trend Micro, because you have either
downloaded a Trend Micro product or have signed up for the FREE "Weekly Virus
Report." If you would like to change the way you receive email from
Trend Micro, please make changes in your account page at
http://www.antivirus.com/subscriptions/default.asp?email=amulya@amulya.net
 
To UNSUBSCRIBE go to:
http://www.antivirus.com/subscriptions/default.asp?format=unsubscribe
 
For questions regarding viruses, please contact the Virus Doctor at
Virus_Doctor@trendmicro.com.
 
For questions regarding products, please contact Tech Support at
support@trendmicro.com.
 
For questions, comments, and suggestions about the Weekly Virus Report
please contact our editor at Newsletters@trendmicro.com.
************************************************************************
Received on Sat Dec 22 01:44:51 2001