Trend Micro Weekly Virus Report - September 12, 2003

*********************************************************************
TREND MICRO WEEKLY VIRUS REPORT
    
(by TrendLabs Global Antivirus and Research Center)
*********************************************************************
------------------------------------------------------------------------
Date: Friday September 12, 2003
------------------------------------------------------------------------
To read an HTML version of this newsletter, go to:
http://www.trendmicro.com/en/security/report/overview.htm

Issue Preview:

1. Trend Micro Updates - Pattern File & Scan Engine Updates
2. Ice is Nice – WORM_NEROMA.A (Low Risk)
3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
4. Head-to-Head Comparison: Web Security Performance

NOTE: Long URLs may break into two lines in some mail readers.
Should this occur, please copy and paste the URL into your browser window.

************************************************************************

1. Trend Micro Updates - Pattern File & Scan Engine Updates
------------------------------------------------------------------------
PATTERN FILE: 630 http://www.trendmicro.com/download/pattern.asp

NOTE: PATTERN FILE SERVICE PACK AVAILABLE FOR TREND MICRO CUSTOMERS AT:
http://www.trendmicro.com/en/support/ausp/overview.htm
 
SCAN ENGINE: 6.510 http://www.trendmicro.com/download/engine.asp

2. Ice is Nice – WORM_NEROMA.A (Low Risk)
------------------------------------------------------------------------
WORM_NEROMA.A is a mass-mailing worm that sends copies of itself as an
attachment, to all addresses listed in the infected user’s Microsoft
Outlook address book. It affects computers running Windows 95, 98, ME,
NT, 2000, and XP.

Upon execution, this worm copies itself to the Windows directory as
NEROSYS.EXE, and creates autostart registry entries. It propagates by
sending copies of itself as an email attachment with the following:

Subject: It’s Near 911!

Message Body: ice butt baby!

Attachment: 911.jpg

The displayed attachment name is 911.jpg but the actual file name is
NEROSYS.EXE, the real name and executable copy of the worm.

Due to possible programming errors in its code, the email Message Body
is displayed as “ice butt baby!” instead of “nice butt baby!”

If you would like to scan your computer for WORM_NEROMA.A or thousands
of other worms, viruses, Trojans and malicious code, visit HouseCall,
Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/

WORM_NEROMA.A is detected and cleaned by Trend Micro pattern file #627
and above.

For additional information about WORM_NEROMA.A please visit: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NEROMA.A

3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US
(week of: September 1, 2003 to September 7, 2003)
------------------------------------------------------------------------
1. WORM_SOBIG.F
2. JAVA_BYTVERIFY.A
3. WORM_MSBLAST.A
4. WORM_SPYBOT.GEN
5. WORM_BUGBEAR.A
6. WORM_MSBLAST.D
7. WORM_KLEZ.H
8. PE_DUMARU.A
9. WORM_KWBOT.C
10. TROJ_SMALL.M
        
4. Head-to-Head Comparison: Web Security Performance
------------------------------------------------------------------------
Trend Micro commissioned VeriTest to compare the performance of its
InterScan Web Security Suite 1.0 to Symantec Web Security 3.0 and McAfee
WebShield e1000 appliance using PC Magazine’s WebBench 4.01 Web server
performance benchmarking software. All three products tested work in
conjunction with a Web server to monitor HTTP and FTP traffic for known
viruses. The goal of the testing was to compare the performance of the
three products while each filtered HTTP and FTP traffic to several client
systems. View and compare the results of all three products:
http://www.trendmicro.com/en/products/gateway/iwss/evaluate/white-papers.htm

***********************************************************************************

______________________________________________________________________
This message was sent by Trend Micro's Newsletters Editor using Responsys Interact (TM).

If you prefer not to receive future e-mail from Trend Micro's Newsletters Editor:
    
R2pkNlyLihkm_C_UV_TW

To view our permission marketing policy:
    http://www.rsvp0.net
Received on Sat Sep 13 03:15:23 2003