Trend Micro Weekly Virus Report - July 12, 2002

*********************************************************************
TREND MICRO WEEKLY VIRUS REPORT
    
(by TrendLabs Global Antivirus and Research Center)
*********************************************************************
------------------------------------------------------------------------
Date: July 12, 2002
------------------------------------------------------------------------
To read an HTML version of this newsletter, go to:
http://www.trendmicro.com/trendsetter/virus_report/

Issue Preview:

1. Trend Micro Updates - Pattern File and Scan Engine Updates
2. LILAC Project Video - WORM_LIAC.A (Low Risk)
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
4. Last Chance to Save - Upgrade to PC-cillin 2002 and save 50%

NOTE: Long URLs may break into two lines in some mail readers.
Should this occur, please copy and paste the URL into your browser window.

************************************************************************

1. Trend Micro Updates - Pattern File and Scan Engine Updates
------------------------------------------------------------------------
PATTERN FILE: 315 http://www.trendmicro.com/download/pattern.asp
SCAN ENGINE: 6.150 http://www.trendmicro.com/download/engines/

2. LILAC Project Video - WORM_LIAC.A (Low Risk)
------------------------------------------------------------------------
This worm sends itself to all email addresses listed in the infected system's Windows Address Book. It arrives as an email attachment with a movie file icon, in a message with the following details:

Subject: LILAC project video attach

Message Body: Things that the govt. dont want you to know

Attachment: LILAC_WHAT_A_WONDERFULNAME.avi.exe

To execute its mass-mailing routine properly, this worm requires that a copy of itself is available in the Windows temp folder. This condition is true if it is executed as an attachment in Microsoft Outlook.

It checks for the presence of certain directories in drive C:\, and drops a copy of itself into the last directory it finds, using the filename LILAC_WHAT_A_WONDERFULNAME.AVI.EXE. It then creates a registry entry so that its dropped copy is executed at every Windows startup.

It sends itself as an attachment to all email addresses listed in the infected system's Windows Address Book (WAB). The worm then registers itself as a process using the program name "Windows."

If you would like to scan your computer for WORM_LIAC.A or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free online virus scanner at: http://housecall.antivirus.com/

WORM_LIAC.A is detected and cleaned by Trend Micro pattern file #309 and above.

For additional information about WORM_LIAC.A please visit: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_LIAC.A

3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
(week of: July 1, 2002 to July 7, 2002)
------------------------------------------------------------------------
1. WORM_KLEZ.H
2. JS_NOCLOSE.E
3. WORM_YAHA.E
4. TROJ_NETBUS.170
5. PE_ELKERN.D
6. PE_CIH.1003
7. PE_MAGISTR.A
8. JS_EXCEPTION.GEN
9. VBS_LOVELETTR.AS
10. PE_NIMDA.E

4. Last Chance to Save - Upgrade to PC-cillin 2002 and save 50%
------------------------------------------------------------------------
For only $19.95, you can enjoy the benefits of:

- Enhanced antivirus scanning
- A personal firewall for Internet connection security
-Integrated security for your Personal Digital Assistant (PDA)

Trend Micro is pleased to announce the release of PC-cillin 2002, one of the best desktop antivirus software programs on the market. PC-cillin 2002 comes with an integrated personal firewall that helps secure desktop computers against illegal access, ping attacks, and even port scanning for Internet-era protection. This complete antivirus strategy also includes security for Palm, Pocket PC, and EPOC devices.

Act now. Offer expires July 31st.

BUY NOW: http://www.digitalriver.com/dr/v2/ec_MAIN.Entry17c?CID=53432&PN=5&SP=10007&SID=16269&PID=260056&DSP=&CUR=840&PGRP=0&CACHE_ID=53432

Offer applies to customers in the U.S. and Canada only.

************************************************************************
You are receiving this email from Trend Micro, because you have either
downloaded a Trend Micro product or have signed up to receive the "Weekly Virus
Report." If you would like to change the way you receive email from
Trend Micro, please make changes in your account page at
http://www.trendmicro.com/subscriptions/default.asp?email=trendmicro_pattern@netzwerk-aktiv.com
 
To UNSUBSCRIBE go to:
http://www.trendmicro.com/subscriptions/default.asp?format=unsubscribe
 
For questions, comments, and suggestions about the Weekly Virus Report
please contact the Newsletters Editor at newsletters@trendmicro.com.
************************************************************************
Received on Sat Jul 13 03:56:29 2002