V I R U S R E P O R T

[Guest guest]

*************************************************************************

V I R U S R E P O R T

(by the Trend Micro US Virus Research Group)

*************************************************************************

-------------------------------------------------------------------------

Date: 03.29.2000 Issue: March/04

-------------------------------------------------------------------------

To read an HTML version of this newsletter, go to:

http://www.antivirus.com/trendsetter/virus_report/

If you're a corporate user and want to assess your virus protection, check

out Trend's new Virus Risk Assessment website at:

http://www.antivirus.com/free_tools/edoctor/

Issue Preview:

1. IROK and VBS_IROK (New virus reported in-the-wild)

2. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend US.

3. Top 10 Viruses Trend US Customers are Most Concerned About.

4. TROJ_PLATAN (Another new password stealer)

*************************************************************************

1. IROK and VBS_IROK (New virus reported in-the-wild)

-------------------------------------------------------------------------

IROK (VBS_IROK) is a new virus, which spreads via Microsoft Outlook and IRC

(Internet Relay Chat). Once executed, IROK displays a black screen with

stars, which disappears once a key is pressed. At the same time, IROK copies

itself to the Windows System directory and drops the file " IROKRUN.VBS " to

the Windows Startup directory. It also searches the drive for other

executables and tries to infect them. IROK also spams itself by modifying

the script.ini file in the mIRC directory and by mailing an email attachment

(IROK.EXE) to the first 60 entries in the Microsoft Outlook address book.

The subject of the email is: " I though you might like to see this. "

For additional information about IROK or VBS_IROK, please visit our website

at:

http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=IROK

IROK (VBS_IROK) is detected with Trend pattern file # 675 and above.

2. 10 Most Prevalent In-The-Wild Malware Surveyed by Trend US

(week of: 03/20/2000 to 03/26/2000)

-------------------------------------------------------------------------

1. TROJ_PRETTY_PARK

2. TROJ_SKA

3. VBS_KAKWORM.A

4. JOKE_FLIPPED

5. JOKE_GESCHENK

6. VBS_NETLOG.WORM

7. VBS_FREELINK

8. JOKE_BUTTONS

9. TROJ_APS.216576

10. JOKE_WOW

Trend Micro also offers the first real-time World Virus Tracking Center,

which shows the regional distribution of viruses worldwide during the past

24

hours, past 7 days and past 30 days.

The World Virus Tracking Center can be accessed at:

http://wtc.trendmicro.com/wtc/

3. Top 10 Viruses Trend US Customers are Most Concerned About

(where systems were not infected)

-------------------------------------------------------------------------

1. TROJ_PRETTY_PARK

2. TROJ_SKA

3. VBS_KAKWORM.A

4. TROJ_SUB7GOLD.21

5. O97M_TRISTATE

6. W97M_MARKER

7. TROJ_SKA

8. PE_MELTING.A

9. TROJ_APS.216576

10. W97M_MARKER.CE

4. TROJ_PLATAN (Another new Password stealer)

---------------------------------------------------------------------------

On a regular basis, we receive new Password stealers that try to steal login

and password information from Dial-up Internet users. One of the most

recent

ones is TROJ_PLATAN. Upon execution, TROJ_PLATAN copies itself to the

Windows System directory (IEXPAND.EXE) and then modifies the system registry

so that it is activated whenever the system is rebooted.

Upon reboot, TROJ_PLATAN collects system passwords and then emails them to

an

email address. Included in the outgoing email is also the IP address of the

infected user.

For additional information about TROJ_PLATAN, please refer to:

http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_PLATAN

TROJ_PLATAN can be detected and with Trend pattern file #675 or above.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Have you got friends or colleagues who would like to receive the Trend Virus

Report? Forward this email and direct them to click on URL to subscribe:

http://www.antivirus.com/subscriptions/default.asp

To unsubscribe to this newsletter, go to :

http://www.antivirus.com/subscriptions/default.asp?uid=jinjanaol

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

___________________________________

*Medical Resources and Support*

http://www.elderwyn.com/medicallinks

*Aisha Elderwyn*

http://www.elderwyn.com/aisha