[Fwd: Macro Virus List June 30, 1997]

[hseaver@xxxxxxxx]

--
Harmon Seaver    Assistant Director for Systems   
Biomedical Library    University of South Alabama    Mobile, AL
36688
hseaver@xxxxxxxx    334-461-1377

--- Begin Message ---

Subject: Macro Virus List June 30, 1997
From: Klaus Brunnstein mailto:brunnstein@DOMAIN.HIDDEN
Date: 13 Aug 1997 02:34:41 -0000

Approved: mailto:virus-l@DOMAIN.HIDDEN

        =========================================
                SUMMARY:
          Macro Virus List (PC + Macintosh)
          according to VTC name specification
         including (PC) In-The-Wild Indication
        =========================================

            Vesselin Bontchev @ FSI
          + Klaus Brunnstein, Uni-Hamburg
          + Joern Dierks, VTC Uni-Hamburg
          + Thomas Buck, VTC Uni-Hamburg
            VTC = Virus Test Center
            Status: June 30, 1997

     >>> Copyright (c) 1997 University of Hamburg, Germany <<<


The number of known macro viruses in June 1997 grew again significantly:
with 18 new strains 132 new viruses, growth was significantly reduced as
compared to previous months (e.g. 37 new strains with 246 new viruses in
May). Only 22 months after Microsoft shipped the first Word macro virus
(Concept.A), the 1000th macro virus was reported around June 20, 1997.

Strains with fastest growth include Showoff (+15) as well NPAD and
CAP (+12) whereas growth of Wazzu (+5) and Concept (+3) is moderate.

The "list of known macro viruses", dated June 30, 1997, reports in
detail about all known macro-related malware. Here are the essential
statistical data:

                Word  +  Other = Total  (New)
   --------------------------------------------------------------
   Number of Strains      214  +   15 =  229  ( 18)
   Number of Viruses     1051  +   14 =  1065  (132)
   Number of Trojans      21  +    7 =   28  ( 0)
   Number of Generators     10  +    0 =   10  ( 0)
   Number of Intendeds     22  +    1 =   23  ( 0)
   Number of Jokes        0  +    1 =   1  ( 0)
   --------------------------------------------------------------
   Remarks: (*)=(viruses+trojans+intendeds+jokes)


The following 14 new WORD macro virus strains have been reported in June 1997:

Balrog.A:Sp, Childish.A, Dracula.A, Goldsecret.A, Illiterate.A, Panjang.A,
Red.A:De, Schumann.A, Since.A, Socks.A, Underground.A, Vampire.A:-B.Tw(2),
Veneno.A:Sp, Vicinity.A-B:De(2)


In addition, 4 new virus strains replicating under WORD97 have been reported:

Calendar.A, Cmd.A, Sparkle.A, Rehenes.A


The following 132 variants of previously known macro viruses have been
reported in June 1997:

Alien.F, Alliance.B, Anarchy.6093, Bandung.AP-AR(3), Bismark.E, Box.C:Tw,
CAP.B,C,N-W(12), Clock.I:De, Colors.BC-BK(9), Concept.AT-AV(3),
CVCK1.I, DMV.F, Dzt.E-F(2), Goldfish.C, Hybrid.D-F(3), Imposter.D,
Irish.Q, Johnny.C1,N,N1(3), Killok.C, Kompu.D-F(3), Lunch.D, MDMA.S-U(3),
Muck.F, NiceDay.K-M(3), NJ-WMDLK1.J, NOP.J-L:De(3), Npad.BQ-BZ,CA-CB(12),
Nuclear.N, PayCheck.D, Pesan.B, Pig.F:Tw, Rap.AJ2, Rats.D, ShowOff.BD-BR(15),
Smiley.C:De, Swlabs.C-D(2), Temple.B, Trap.D:Tw, Twno.Y:Tw, TwoLines.J-N1(9),
Wazzu.CE-CI(5)


The following new viruses were found to replicate esp. under Word97:
Concept.A, DWMVCK1.A-B(2), Minimal.D


The following new viruses replicate under MS Excel and Excel 97:
ExcelMacro/Laroux.D-E(2)


Finally, one macro virus generator was reported:
WordMacro/NJ-WMVCK.2B

==============================================================================
AVAILABILITY
==============================================================================

 This list is published monthly (normally between the 3rd and 8th of a month)
 and can be downloaded via FTP from VTCs "new" WWW/FTP site:

 ftp://agn-www.informatik.uni-hamburg.de/pub/texts/macro/

 The filenames used are:
 MACROLST.yym    (long version)
 MACROL_S.yym    (short version)

 "yym" stands for:

 yy = Year,
 m = Month ("1"..."9" for January...September and
       "A" = October, "B" = November, "C" = December.

Both lists are also available from VTCs "old" ftp site:

ftp.informatik.uni-hamburg.de/pub/virus/macro/macrolst.*

==============================================================================



--- End Message ---