[Date Prev][Date Next][Subject Prev][Subject Next][ Date Index][ Subject Index]

[Fwd: List of Known Macro Viruses: May 1997]

Contrary to various assertions that there are no email viri, it has
been well established that there are indeed such viri, and that they do
*not* require opening any attachments. Macro viri are activated when you
open (read) the document.
    They do, however, only work with certain types of software, namely,
MS-Word, MS-Mail, Excel, and, more recently, ccmail. -- although there
may be more that I haven't heard of. And, most definitely, some for
MS-Mail grab the address list and replicate themselves to those
addresses. 

-- 
Harmon Seaver        Assistant Director for Systems        
Biomedical Library        University of South Alabama        Mobile, AL
36688
hseaver@xxxxxxxx        334-461-1377
--- Begin Message --- 
                   =========================================
                                  SUMMARY:
                       Macro Virus List (PC + Macintosh)
                      according to VTC name specification
                     including (PC) In-The-Wild Indication
                   =========================================

                          Vesselin Bontchev @ FSI
                       +  Klaus Brunnstein, Uni-Hamburg
                       +  Joern Dierks, VTC Uni-Hamburg
                       +  Thomas Buck, VTC Uni-Hamburg
                          VTC = Virus Test Center
                          Status: May 31, 1997

            >>> Copyright (c) 1997 University of Hamburg, Germany <<<


The number of macro viruses has significantly grown in May 1997: with
37 new strains and 246 new macro viruses (almost all replicating on
Word documents). The number grew faster than in every previous month.
Strains with fastest growth include NPAD (+19), Bandung (+16),
Colors (+14), Twno (+14), Showoff (+13) and Rapi (+13) whereas the growth
has diminished in strains such as Wazzu (+10) and Concept (+8).

The "list of known macro viruses", dated May 31, 1997, reports in
detail about all known macro-related malware. Here are the essential
statistical data:


                                   Word   +   Other  =  Total    (New)
        --------------------------------------------------------------
        Number of Strains           196   +      15  =    211    ( 37)
        Number of Viruses           921   +      12  =    933    (246)
        Number of Trojans            22   +       7  =     29    (  3)
        Number of Generators         10   +       0  =     10    (  0)
        Number of Intendeds          22   +       1  =     23    (  4)
        Number of Jokes               0   +       1  =      1    (  0)
        --------------------------------------------------------------
        Remarks: (*)=(viruses+trojans+intendeds+jokes)


The following 37 new macro virus strains have been reported in April 1997:

   Anak.A, Ant.A-B:Tw, Attack.A, Beeper.A-B, Chaka.A, Chandigarh.A, Cult.A.int,
   CVCK1.C-H, Czech.A, Dakota.A,B:De, Dance.A, Defender.A, Demon.A, Divina.F,
   Doggie.E, Donos.A.int, Envader.A.int, Hark.A, Hyper.A,A1, Java.A, Killok.A-B, Lox.A,
   Mark.A-B:Tw, Minimorph.A, Noprint.A, Ordo.A, Orhey.A, Pesan.A, Quick.A, Randomic.A,
   Rellk.A:Tw, Strezz.A, Sunbeam.A, Trap.A-C:Tw, Varmint.A:Tw, Why.A.drp,Zoolog.A


The following 209 variants of previously reported macro viruses have been reported in April 1997:

   Alien.D-E, Appder.D-E, Bandung.Y-Z,AA-AO, CAP.J-M, Cebu.B, Colors.AP-AZ,BA-BB,
   Concept.AL-AS, Dzt.D, Epidemic.B-C:Tw, Friday.C:De, Gambler.A-D, Goldfish.B, Irish.K-P,
   Johnny.A2,B1-M1, JunkFace.B,C.int, Kompu.C, MDMA.N-R, Minimal.N-P, Muck E,
   NiceDay E-J, NJ-WMDLK1.H, NOP.K, Npad.AX-AZ,BA-BP, Nuclear.L-M, PayCheck.B-C,
   Pig.B-E:Tw, Rapi.M1,AD2-AI2, ShowOff.AQ-AZ,BA-BC, Slow.B,B.drp, Spiral.B, Switcher.A-B,
   Talon.I-K, Twno.K-X:Tw, TwoLines.E-I1, Wazzu.BU-BZ,CA-CD, WMVH1.B-:Tw


The following new viruses were found to replicate esp. under Word97:

   Appder.B-C, Bismark.B-D, Lunch.A-B, Minimal.A-B, Opim.A, Rapi.A2, Wazzu.X


The following new viruses replicate under MS Excel and Excel 97:

   LMV.D.trj, Tjoro.A


==============================================================================
AVAILABILITY
==============================================================================

 This list is published monthly (normally between the 3rd and 8th of a month)
 and can be downloaded via FTP from VTCs "new" WWW/FTP site:

 ftp://agn-www.informatik.uni-hamburg.de/pub/texts/macro/

 The filenames used are:
    MACROLST.yym        (long version)
    MACROL_S.yym        (short version)

 "yym" stands for:

    yy = Year,
    m  = Month ("1"..."9" for January...September and
                "A" = October, "B" = November, "C" = December.

Both lists are also available from VTCs "old" ftp site:

   ftp.informatik.uni-hamburg.de/pub/virus/macro/macrolst.*

==============================================================================

--- End Message ---