Download Computer Virus Incident Report for June 2011 1. Virus Detection

Attachment 1
Computer Virus Incident Report for June 2011
1. Virus Detection Count by Month
2. Virus Report Count by Month
-1-
Attachment 1
3. Virus Report Count by Year
-2-
Attachment 1
4. Viruses Reported in June 2011
51 types of viruses were reported in June, with 1,164 reports related to Windows/DOS and 37
reports to script virus and macro virus and 8 reports to PDA virus.
i）
Windows
Windows/DOS virus
The symbol * indicates a new virus
Report count
Script virus
Report count
W32/Netsky
W32/Autorun
242
223
VBS/Solow
VBS/LOVELETTER
8
3
W32/Mydoom
222
VBS/SST
3
W32/Downad
103
VBS/Redlof
1
W32/Mytob
64
VBS/Freelink
1
W32/Mumu
53
VBS/Neer (※)
1
W32/Bagle
40
W32/Gammima
26
W32/Klez
26
W32/Blakcont
20
W32/Sality
W32/Fujacks
20
17
XM/Laroux
WM/Cap
18
1
W32/Virut
15
X97M/Divi
1
W32/Fbound
14
W32/Mywife
13
W32/Funlove
W32/Areses
12
6
Subtotal
17
Macro virus
Report count
Subtotal
20
W32/Mimail
5
ii)PDA
Report count
W32/Palevo
W32/Fakerecy
5
5
AndroidOS/Lotoor
AndroidOS/Lightdd (※)
5
1
W32/Zafi
4
AndroidOS/Smspacem (※)
1
W32/Ramnit
4
AndroidOS/Smstibook (※)
1
W32/Antinny
3
W32/IRCbot
3
Subtotal
8
W32/Allaple
2
W32/Bacterra
2
iii) Macintosh
W32/Defo (※)
2
None
W32/Lovgate
2
W32/Whybo
Stoned
2
1
Diskkiller
1
W32/Poebot
Cascade
1
1
W32/Bobax
1
< Reference information >
W32/Bugbear
1
・ Windows/DOS Virus
W32/Imaut
1
W32/Parite
1
W32/Rontokbro
1
iii) OSS（ OpenSourceSoftware）： Unix including
Linux・ BSD
Linux・ BSD
None
A virus designed to work within the MS -DOS
environment.
・ Macro Virus
A virus designed to exploit the macro feature of
Microsoft Word/ Excel etc
Subtotal
1,164
・ Script Virus
Note: Detection count includes that of
the virus's subspecies
A virus written in a simplified programming
language that does not require source code to
be converted into machine code.
-3-
Attachment 1
Note: denotation in the virus name column has the following meaning:
Code
Meaning
W32
Works in the Windows32- bit environment
XM
Abbreviated form of ExcelMacro for Microsoft Excel95/97
WM
Abbreviated form of WordMacro for Microsoft Word95/97
W97M
Abbreviated form of Word97Macro for Microsoft Word97
X97M
Abbreviated form of Excel97Macro for Microsoft Excel97
VBS
Written in Visual Basic Script(VBS)
Wscript
Works in the Windows Scripting Host environment (excluding VBS)
AndroidOS
Written under Android OS
XF
Works under Microsoft Excel95/97. Abbreviated form of ExcelFormula.
5. Outline of a Computer Virus Whose Report was Submitted for the First Time to
IPA
(1) W32/Defo
This virus infects the system are on a floppy disk or hard disk drive.
After the infection, it creates its copy on that floppy disk so that its infection spreads.
(2) VBS/Neer
This virus is written in Visual Basic Script and infects a file in html format.
After the infection, it creates a large number of its copies and changes a registry so that it is
activated automatically. If this virus is activated, PC is overloaded and stops functioning in the end.
(3) AndroidOS/Lightdd
This virus infects AndroidOS which running on mobile devices.
After the infection, it steals information stored in the mobile device and sends it to an external
party.
(4) AndroidOS/Smspacem
This virus infects AndroidOS which running on mobile devices.
After the infection, it attempts to send a SMS message*1 to the addresses registered in the address
book of the mobile device.
(*1) A service that enables mobile devices of the same carrier to send and receive an e-mail with a short message
for free.
(5) AndroidOS/Smstibook
This virus infects AndroidOS which running on mobile devices.
After the infection, it attempts to send a premium SMS message*2 to the pre-specified number.
(*2) A paid-for short message service from which the destination of the message benefit.
-4-
Attachment 1
6. Report Count by Report Submitter
Reports from corporate users marked the highest count, accounting for about 92 percent.
Report submitter
Corporate user
Individual user
Education
institution
Total
Jun. 2011
1,106
0
103
91.5%
0.0%
8.5%
Report count
May 2011
(previous month)
975
92.9%
0
0.0%
74
7.1%
1,209
Jun. 2010 (the same month a
year ago)
1,156
92.9%
4
0.3%
85
6.8%
1,049
1,245
7. Report Count by Route of Infection (Finding)
As the route of infection (finding), e-mail marked the highest count, accounting for about 90 percent.
Route of infection (finding)
Report count
May 2011
(previous month)
982
93.6%
Jun. 2011
E-mail
Jun. 2010 (the same month a
year ago)
1,138
91.4%
1,085
89.7%
Downloading (*)
10
0.8%
7
0.7%
0
0.0%
External Media
2
0.2%
0
0.0%
3
0.2%
112
0
9.3%
0.0%
58
2
5.5%
0.2%
104
0
8.4%
0.0%
Network
Unknown/other routes
Total
1,209
1,049
1,245
(*) Including those that were infected by accessing a Web Page
8. Number of PCs Infected
Number of PCs infected
Report count
May 2011
(previous month)
1,046
99.7%
1
0.1%
2
0.2%
0
0.0%
0
0.0%
0
0.0%
0
0.0%
Jun. 2011
0
1
2–4
5–9
10 – 19
20 - 49
50 or more
1,209
0
0
0
0
0
0
Total
1,209
100.0%
0.0%
0.0%
0.0%
0.0%
0.0%
0.0%
1,049
Jun. 2010 (the same month a
year ago)
1,244
99.9%
0
0.0%
0
0.0%
1
0.1%
0
0.0%
0
0.0%
0
0.0%
1,245
Computer Virus Incident Reporting Program
This program was established and enforced in April 1990 by the Ministry of Economy, Trade and Industry
(METI) according to its computer virus prevention guidelines and encourages those who detected
computer viruses to report them to IPA so that the recurrence or the spread of such infection can be
prevented. While IPA responds individually to each report submitter, it also establishes countermeasures
against virus incidents, based the reports submitted. Submitted reports are carefully handled to protect the
privacy of report submitters and used solely for the purpose of analyzing damage situation and
periodically releasing our findings.
Computer Virus Prevention Guidelines:
Established on April 10, 1990 (METI release No. 139)
Amended on July 7, 1995 (METI release No. 429)
Amended on September 24, 1997 (METI release No. 535)
Amended on December 28, 2000 (METI release No. 952)
Amended on January 5, 2004 (METI release No. 2)
Contact to:
IT Security Center, Information-technology Promotion Agency,
Japan (IPA/ISEC)
Kagaya/Miyamoto
Tel: +81-3-5978-7591; Fax: +81-3-5978-7518;
E-mail:
-5-