If it’s in the news, there’s probably a computer virus about it. After computer virus writers failed to get much traction by tying a series of malicious programs to the war in Iraq, now there’s a virus that poses as information about the SARS health crisis.
THE WORM, which has been dubbed “Coronex,” is designed to arrive in a potential victim’s e-mail inbox with subject lines like “Severe Acute Respiratory Syndrome” or “SARS Virus.”
Antivirus firms haven’t heard from any customers who say they’ve been infected by Coronex, and they are optimistic the computer worm won’t spread.
Coronex may arrive from a variety of e-mail addresses, including sars@hotmail.com, sars2@hotmail.com, or virus@china.com. Users must click on an attached file for their computer to become infected. The file might also have a variety of names, such as SARS.exe or Hongkong.exe.
The consequences of infection are familiar — the worm will send copies of itself to everyone in the infected user’s e-mail address book.
Users who avoid clicking on such attachments will be safe.
FAMILIAR TRICK
The trick to virus-writing infamy is a good hook. People couldn’t resist clicking on the “LoveBug” virus e-mail because it promised a tender note from a loved one; the “Anna Kournikova” virus succeeded because victims hoped to see a picture of the heartthrob tennis star. Virus writers know this, and often spend as much time developing their pitch as they do programming their code.
It’s common to hide viruses as information about prominent news events. A recent virus named “Ganda” promised satellite pictures of Iraq, according to antivirus firm Sophos. There were a variety of computer viruses that took advantage of the anthrax scare following Sept. 11, and others mentioned the war in Afghanistan or the search for Osama bin Laden.
“There’s a large element of psychology with viruses,” said Chris Belthoff, senior product manager with Sophos. “Virus writers feel they can use some news event that’s relevant to get people to click.”
But apparently, it doesn’t work very well. Neither Ganda nor Coronex have caused any reported infection, Belthoff said. And he couldn’t recall any news-based computer virus that has spread.
Dee Liebenstein, group product manager at Symantec Corp., said only one news-based malicious program had ever gained traction: a bug named “War vote,” released just after Sept. 11, 2001, which purported to be a survey of sentiment for a war against Afghanistan.
“But that wasn’t a full outbreak,” she said. Computer worms crafted to take advantage of late-breaking news tend to be hastily developed and not very sophisticated, she said. “We’ve seen a lot (news-based viruses) and we really haven’t seen a great deal of success with them. ... They are more about trying to get attention with the message them trying to do damage.”
