Trend Bulletin

GoneShootin

2. Variants Galore -- WORM_MALDAL (Low Risk)

---

WORM_MALDAL.C is a destructive, memory-resident worm that propagates via
Microsoft Outlook and deletes files in the Windows system directory upon
execution.

WORM_MALDAL.D is another destructive memory-resident worm that propagates by
email via Microsoft Outlook. It drops a copy of itself named WIN.EXE in the
System directory and deletes antivirus programs and certain files.

WORM_MALDAL.E is a variant of WORM_MALDAL.C and WORM_MALDAL.D. It also propagates
via email by using Microsoft Outlook and deletes antivirus software and other files
upon execution.

For additional information about all WORM_MALDAL variants, please visit the
Trend Micro Virus Information Center at:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_MAL=
DAL.C
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_MAL=
DAL.D
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_MAL=
DAL.E

WORM_MALDAL.C is detected by Trend Micro pattern file #186 or #986, WORM_MALDAL.D
and WORM_MALDAL.E are detected by pattern file #192 or #992.

3. 10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro in the US
(week of: December 24, 2001 through December 30, 2001)

---

1. WORM_BADTRANS.B
2. PE_MAGISTR.B
3. PE_MAGISTR.A
4. PE_MTX.A
5. TROJ_DLDER.A
6. WORM_SIRCAM.A
7. WORM_BADTRANS.A
8. WORM_ZOHER.A
9. PE_CIH
10. WORM_HYBRIS.M