Reporting Status of Computer Virus - Details for August 2008 I

Atachment 1

Reporting Status of Computer Virus - Details for August 2008 I. Details for Reported Number of Virus 1. Detection Number of Virus by Month

Detection Number of Virus/Month

180

158 160

140 131

120 117 105 102 100

80 77 69 66 62 60 60 50 51 49 50 44 40 34 31 26 24 21 21 20 19 19 20

0 Sep. Oct. Nov. Dec. Jan. Feb. Mar. Apr. May Jun. Jul Aug. Sep. Oct. Nov. Dec. Jan. Feb. Mar. Apr. May Jun. Jul. Aug. '06 '07 '08 Information-technology Promotion Agency, Security Center (IPA/ISEC)

2. Reported Number of Virus by Month

Reported Number of Virus/Month

6500 - The gross reported number/respective months are 6000 indicated at the upper part of the graph in Bold. 5500 - Respective pale green bars indicate the detected number of virus/month before infected to a computer. 5000 - The shaded part underneath of respective bars indicates 4500 the number of cases actually infected by virus. 4000 3,696 3,551 3,664 3,513 3,383 3500 3,212 3,199 3,098 3,069 2,933 3000 2,898 2,806 2,419 2,239 2,426 2500 2,351 2,046 2,002 2000 2006 1,854 1,703 1,811 1,651 1,737 (44,840) 2007 1,448 1500 (34,334) 2008 1000 (12,441) 500 22 11 28 5 8 13 5 12 17 5 1 7 2 0 3 7 23 5 5 9 8 4 2 3 0 Sep. Oct. Nov. Dec. Jan. Feb. Mar. Apr. May Jun. Jul Aug. Sep. Oct. Nov. Dec. Jan. Feb. Mar. Apr. May Jun. Jul. Aug. '06 '07 '08 Information-technology Promotion Agency, Security Center (IPA/ISEC)

1 Atachment 1

3. Reported Number of Virus by Year

Reported Number of Virus/Year

60,000

54,174 52,151

50,000

44,840

40,000

34,334 Same periods (Jan. to Aug.) in 30,000 previous year 24,261 24,899

20,352 20,000 17,425 14,252 11,109 10,000

3,645 2,391 2,035 668 755 0 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 Information-technology Promotion Agency, Security Center (IPA/ISEC)

2 Atachment 1

4. Viruses Reported in August 59 kinds of viruses were reported. 1,765 were the number relevant to Windows/DoS virus and 47 were for macro/script viruses. i) Windows (*) = newly emerged virus for the month. Windows/DOS Virus Reported Number Windows/DOS Virus Reported Number W32/Netsky 353 W32/Niumu (*) 1 W32/Mydoom 170 W32/Polip 1 W32/Virut 165 W32/Rahack 1 W32/Bagle 147 W32/Tenga 1 W32/Mytob 141 W32/Traxg 1 W32/Klez 114 W32/Welchia 1 W32/Sality 84 W32/Stration 81 Sub Total 1,764 W32/Autorun 65 W32/Funlove 61 Macro Virus Reported Number W32/Mywife 54 X97M/Divi 3 W32/Lovegate 50 XM/Laroux 3 W32/Saros 39 XF/Helpopy 1 W32/Zafi 38 XF/Sic 1 W32/Gammima 26 W32/Bugbear 24 Sub Total W32/Nuwar 22 W32/Mimail 21 Script Virus Reported Number W32/Grum 14 VBS/Solow 20 W32/Parite 11 VBS/SST 8 W32/Womble 10 VBS/Redlof 6 W32/IRCbot 9 VBS/LOVELETTER 2 W32/Nimda 8 VBS/Modezimia 2 W32/Mumu 7 Wscript/Kakworm 1 W32/Bacterra 5 W32/Rinbot 5 Sub Total 39 W32/Mabutu 4 W32/Rontokbro 4 W32/Bagz 3 W32/Fakerecy 3 W32/Agist (*) 2 W32/Areses 2 W32/Chir 2 W32/Dumaru 2 ii) Macintosh W32/Looked 2 None W32/Mabezat 2 W32/Whybo 2 iii) OSS (Open Source Software): Linux, BSD inclusive of UNIX W32/Almanahe 1 None W32/Feebs 1 W32/Fujacks 1 iv) Mobile Terminal W32/Honk 1 None W32/Imaut 1 W32/Licum 1 Windows/DOS Virus: work under Windows, MS-DOS environment. Macro Virus: exploits macro functions of MS-WORD or MS-EXCEL. Script Virus: is written by simple program to run w/o conversion process to a machine code. Remarks:

Reported Number includes viruses’ variants.

3 Atachment 1

Note: Each acronym and abbreviation in the virus name column mean as follows. Acronym/ Subjected Virus Abbreviation W32 Work under Windows-32bit environment XM MSexcel95, 97 (Abbreviation of Excel Macro) WM MSword95, 97 (Abbreviation of Word Macro) W97M MSword97 (Abbreviation of MSword97 Macro) X97M MSexcel97 (Abbreviation of MSexcel97 Macro) VBS Written by Visual Basic Script Wscript Works under Windows Scripting Host environment (excl. VBS) JS Written by JavaScript XF Work under MSexcel95, 97 (Abbreviation of ExcelFormula) Linux Work under Linux environment FreeBSD Work under FreeBSD environment Perl Written by Perl language OSX Work under Macintosh OS X environment SymbOS Work under Symbian OS environment

V. General Descriptions of the Viruses Initially Reported to IPA in August

(1) W32/Agist: This virus enlarges infection via the virus file (s) appended to an e-mail (s). When infected, the virus creates its copy within the computer and alters the system so that each time the virus is executed upon starting up the computer. In addition, the virus searches/collects mail addresses stored in that computer to send virus mail (s) to the addresses acquired to enlarge infection.

(2) W32/Niumu: This virus enlarges infection to specific file (s) that has .exe extension, etc. When infected, the virus creates its copy within the computer. It also searches those files that have .exe and/or .scr extensions within that computer to enlarge infection. In addition, the virus monitors accessing status to homepages and attempts to send the password (s) being input outside.

VI. The Reported Number Classified by Filers The largest reported number is from general corporate users which constitute about 91% against the whole. Reported Number August 2007 Filer July 2008 August 2008 (The same month a (Previous month) year ago) General Corporate 1,652 91.2% 1,236 85.4% 2,619 93.3% Users Individual Users 5 0.3% 2 0.1% 1 0.0% Education/Research 154 8.5% 210 14.5% 186 6.6% Institution Total 1,811 1,448 2,806

4 Atachment 1

VII. The Reported Number Classified by Infection Source The largest reported number infected is by mails which constitute about 98% against the whole. Reported Number August 2007 Infection Source July 2008 August 008 (The same month a (Previous month) year ago) Via e-mail 1,773 97.9% 1,420 98.1% 2,765 98.5% Downloading (*) 1 0.1% 1 0.1% 0 0.0% Outside Media 12 0.7% 6 0.4% 2 0.1% Network 24 1.3% 19 1.3% 38 1.4% Unidentified/Other 1 0.1% 2 0.1% 1 0.0% Total 1,811 1,448 2,806 (*) including infection from the Home Pages.

VIII. Nos. of Computers Being Infected Reported Number August 2007 Infected Nos. July 2008 August 2008 (The same month a (Previous month) year ago) 0 1,808 99.8% 1,446 99.9% 2,799 99.8% 1 1 0.1% 2 0.1% 4 0.1% 2 – 4 1 0.1% 0 0.0% 1 0.0% 5 – 9 0 0.0% 0 0.0% 1 0.0% 10 – 19 0 0.0% 0 0.0% 0 0.0% 20 - 49 1 0.1% 0 0.0% 1 0.0% 50 or more 0 0.0% 0 0.0% 0 0.0% Total 1,811 1,448 2,806

Computer Virus Incident Reporting Program The Ministry of Economy, Trade and Industry announced "Computer Virus Prevention Guidelines" to prevent the spread of computer viruses in Japan. IPA was designated to receive the "Computer Virus Damage Report" directly from the infected users to investigate virus problem and to provide monthly statistics. This reporting system started in April 1990. Anyone who has encountered computer virus is supposed to send a virus report with necessary information to IPA to prevent further spread and damage of viruses. IPA deals with each reporter (user) on an individual basis as a consultant, and also works as a public research institute for anti-virus measures by analyzing problems showed on the damage report. Taking reporters' privacy into full consideration, IPA periodically publishes the result of their research and analysis on computer virus incident. Computer Virus Prevention Guidelines: Enactment on April 10, 1990 (release No. 139) Amendment on July 7, 1995 (release No. 429) Amendment on September 24, 1997 (release No. 535) Amendment on December 28, 2000 (release No. 952) Amendment on January 5, 2004 (release No. 2)

Contact to: IT Security Center, Information-Technology Promotion Agency (IPA/ISEC) Hanamura/Kagaya/Ooura Tel: +81-3-5978-7527; Fax: +81-3-5978-7518; e-mail: [email protected]