Attachment 1 Reporting Status of Computer Virus - Details for December 2008 I. Details for Reported Number of Virus 1. Detection Number of Virus by Month

Detection Number of Virus/Month

120

102 100

80 77 69 66 62 60 60 50 51 49 50 44

40 34 31 27 26 24 26 21 21 22 20 19 19 20 17

0 Jan. Mar. May Jul. Sep. Nov. Feb. Apr. Jun. Aug. Oct. Dec. '07 Information-technology Promotion Agency, Security Center (IPA/ISEC)

2. Reported Number of Virus by Month

Reported Number of Virus/Month

6 ,00 0 - The gross reported number/respective months are 5 ,50 0 indicated at the upper part of the graph in Bold. - Respective mauve bars indicate the detected number of 5 ,00 0 virus/month before infected to a computer.

4 ,50 0 - The shaded part underneath of respective bars indicate the number of cases actually infected by virus. 2008 4 ,00 0 3,19 9 (21,591) 3,5 13 2007 2 ,9 33 3 ,3 83 3 ,50 0 3 ,0 69 (34,334) 3 ,0 98 2 ,8 98 3 ,00 0 2 ,8 06 2 ,41 9 2 ,2 39 2 ,4 26 2 ,50 0 2 ,3 51 2 ,0 02 1 ,65 1 1,87 5 1 ,8 30 2 ,0 46 1 ,7 37 1 ,8 54 1 ,8 39 2 ,00 0 1,70 3 1,81 1 1 ,79 5 1 ,4 48 1 ,50 0

1 ,00 0

50 0 8 1 3 5 12 17 5 1 7 2 0 3 7 23 5 5 9 8 4 2 3 5 3 1 2 - Jan. Feb. Mar. Apr. May Jun. Jul. Aug. S ep. Oct. Nov. De c. Jan . Fe b. Mar. Apr. May Ju n. Jul. Aug. Se p. Oct. Nov. Dec. '07 '08 Information-technology Promotion Agency, Security Center (IPA/ISEC)

1 Attachment 1

3. Reported Number of Virus by Year

Reported Number of Virus/Year

60,00 0

5 4,174 52,1 51 50,00 0 44,8 40

40,00 0 34,3 34

30,00 0

24, 261 2 1,591 2 0,352 20,00 0 1 7,425

1 1,10 9 10,00 0

3,6 45 2,391 2,035 668 7 55 - 1995 19 96 19 97 1998 19 99 2000 20 01 20 02 2 003 200 4 2 005 200 6 200 7 2 008 Information-technology Promotion Agency, Security Center (IPA/ISEC)

2 Attachment 1

4. Viruses Reported in December 50 kinds of viruses were reported. Windows/DoS virus with 1,773 and macro/script viruses with 22 were the breakdowns. i) Windows (*) = newly emerged virus for the month. Windows/DOS Virus Reported Number Macro Virus Reported Number W32/ 393 X97M/Divi 4 W32/Autorun 258 XM/Laroux 3 W32/ 153 WM/Concept 1 W32/ 144 W32/Mytob 134 W32/Virut 113 W32/ 109 W32/Mywife 91 Sub Total 8 W32/Sality 71 W32/Lovgate 48 Script Virus Reported Number W32/Saros 43 VBS/SST 8 W32/Zafi 39 VBS/Homepage 2 W32/Funlove 29 VBS/Soraci 2 W32/Mimail 26 VBS/Freelink 1 W32/Bugbear 15 VBS/LOVELETTER 1 W32/Womble 14 Sub Total W32/Nuwar 13 W32/Dumaru 11 W32/Bacterra 9 Sub Total 14 W32/Rontokbro 8 W32/Stration 7 W32/Chir 6 W32/ 6 W32/Resourcer 5 W32/Gammima 4 W32/Areses 2 W32/Downad (*) 2 W32/Gaobot 2 W32/Mabezat 2 W32/Mumu 2 W32/Sohanad 2 W32/Zhelatin 2 Anti-CMOS 1 W32/Allaple 1 ii) Macintosh W32/Dzan 1 None W32/Fizzer 1 W32/Flob (*) 1 iii) OSS (Open Source Software): Linux, BSD inclusive of UNIX W32/Licum 1 None W32/Mabutu 1 W32/Mota 1 iv) Mobile Terminal W32/Parite 1 None W32/Swen 1

Windows/DOS Virus: work under Windows, MS-DOS environment. Macro Virus: exploits macro functions of MS-WORD or MS-EXCEL. Script Virus: is written by simple program to run w/o conversion process to a machine code. Remarks:

Reported Number includes viruses’ variants. 1,773

3 Attachment 1

Note: Each acronym and abbreviation in the virus name column mean as follows. Acronym/ Subjected Virus Abbreviation W32 Work under Windows-32bit environment XM MSexcel95, 97 (Abbreviation of Excel Macro) WM MSword95, 97 (Abbreviation of Word Macro) W97M MSword97 (Abbreviation of MSword97 Macro) X97M MSexcel97 (Abbreviation of MSexcel97 Macro) VBS Written by Visual Basic Script Wscript Works under Windows Scripting Host environment (excl. VBS) JS Written by JavaScript XF Work under MSexcel95, 97 (Abbreviation of ExcelFormula)

5. General Description of Virus Initially Reported to IPA in December (1) W32/Downad: This virus exploits security holes and conducts infection activities to the computer connected to the Internet. When infected, the virus creates its copy within the computer to alter to the system so that each time the virus is executed upon starting up the computer. In addition, it automatically accesses to specific website (s) to attempt to download malicious program (s).

(2) W32/Flob: This is one of file infection type of virus. When infected, the virus infects to the program file (s) for which extension is .exe. In addition, it attempts to access to specific website (s).

6. The Reported Number Classified by Filers The largest reported number is from general corporate users which constitute about 93% against the whole. Reported Number Dec. 2007 Filer Nov. 2008 (Previous Dec. 2008 (The same month a month) year ago) General Corporate 1,676 93.4% 1,723 94.2% 2,033 90.8% Users Individual Users 9 0.5% 14 0.8% 12 0.5% Education/Research 110 6.1% 93 5.1% 194 8.7% Institution Total 1,795 1,830 2,239

7. The Reported Number Classified by Infection Path Identified The largest reported number for the infection source is by mails which constitute about 99% against the whole. Reported Number Dec. 2007 Infection Source Nov. 2008 Dec. 2008 (The same month a (Previous month) year ago) Via e-mail 1,779 99.1% 1,816 99.2% 2,183 97.5% Downloading (*) 0 0.0% 0 0.0% 0 0.0% Outside Media 2 0.1% 0 0.0% 6 0.3% Network 14 0.8% 13 0.7% 50 2.2% Unidentified/Other 0 0.0% 1 0.1% 0 0.0% Total 1,795 1830 2,239 (*) including infection from the Home Pages.

4 Attachment 1

8. Nos. of Computers Being Infected Reported Number Dec. 2007 Infected Nos. Nov. 2008 Dec. 2008 (The same month a (Previous month) year ago) 0 1,793 99.9% 1,829 99.9% 2,232 99.7% 1 1 0.1% 0 0.0% 6 0.3% 2 – 4 0 0.0% 0 0.0% 1 0.0% 5 – 9 0 0.0% 1 0.1% 0 0.0% 10 – 19 1 0.1% 0 0.0% 0 0.0% 20 - 49 0 0.0% 0 0.0% 0 0.0% 50 or more 0 0.0% 0 0.0% 0 0.0% Total 1,795 1,830 2,239

Computer Virus Incident Reporting Program The Ministry of Economy, Trade and Industry announced "Computer Virus Prevention Guidelines" to prevent the spread of computer viruses in Japan. IPA was designated to receive the "Computer Virus Damage Report" directly from the infected users to investigate virus problem and to provide monthly statistics. This reporting system started in April 1990. Anyone who has encountered computer virus is supposed to send a virus report with necessary information to IPA to prevent further spread and damage of viruses. IPA deals with each reporter (user) on an individual basis as a consultant, and also works as a public research institute for anti-virus measures by analyzing problems showed on the damage report. Taking reporters' privacy into full consideration, IPA periodically publishes the result of their research and analysis on computer virus incident. Computer Virus Prevention Guidelines: Enactment on April 10, 1990 (release No. 139) Amendment on July 7, 1995 (release No. 429) Amendment on September 24, 1997 (release No. 535) Amendment on December 28, 2000 (release No. 952) Amendment on January 5, 2004 (release No. 2)

Contact to: IT Security Center, Information-Technology Promotion Agency (IPA/ISEC) Hanamura/Kagaya/Ooura Tel: +81-3-5978-7527; Fax: +81-3-5978-7518; e-mail: [email protected]

5