New Computer Virus Brings No Christmas Cheer
Added: (Wed Nov 24 1999)
Pressbox (Press Release) -
A spinoff of an earlier computer virus is set to strike on Christmas Day, erasing hard drives and spoiling the holiday for computer users who had hoped to install new software they found under the tree.
In a year in which there has been a steady stream of computer viruses, anti-virus researchers have now detected a new one making the rounds called W97M.Prilissa.A that is programmed to come to life on Dec. 25. It is an offshoot of the earlier Melissa virus.
Network Associates, an anti-virus company, has classified the new virus as a 'medium threat.' Computer virus updates are available online.
The virus, which arrives via e-mail, includes the subject line 'Message From .' The body text reads, "This document is very Important and you've GOT to read this!!!" and a Word document is attached. If the document is opened, the user becomes infected. Users will know they have been infected from the presence of random characters and objects (multi-colored lines, shapes and letters) in any open Word documents.
Word 97 users will also see a dialogue box with the following text:
'(C) 1999 - cyberNET Vine ... Vide ... Vice ... Moslem Power Never End ... You Dare Rise Against Me ... The Human era is Over, The CyberNET Era Has Come!!! [OK]'
Virus wipes out files
The program will then overlay several colored shapes onto the opened document and then overwrite the AUTOEXEC.BAT file to format the C: drive, and it displays the following text when the system is rebooted:
The instructions to overwrite the AUTOEXEC.BAT include:
'@echo Vine...Vide...Vice...Moslem Power Never End...'
'@echo Your Computer Have Just Been Terminated By
-= CyberNET =- Virus !!!'
'format c: /autotest /q /u'
The next time the computer is turned off and then on, the revamped AUTOEXEC.BAT file will run causing an automatic reformatting of the hard drive. But before that happens, users will see the following message:
'Vine...Vide...Vice...Moslem Power Never End...Your Computer Have Just Been Terminated By -= CyberNET =- Virus!!'
Infects Microsoft documents
The virus infects Microsoft Word 97 Office 2000 documents and spreads itself by sending the infected document as an e-mail attachment using Microsoft Outlook to the first 50 addresses in each address book. Only computers running Windows 95 and Windows 98 are affected.
Vincent Weafer, director of the Symantec AntiVirus Research Center at Symantec Corp., said the virus writer is probably targeting home computer users, suspecting that many of them will try to install software they get as gifts.
"It's not extremely more malicious than we've seen in other programs. ... I think this person is after publicity. The references and text they use, all of this is adding up to say, 'Hey, I'm out here, look at me,'" said Weafer.
He said many of the new virus programs are copycats.
Based on earlier source code
"When Melissa came out last March, within a matter of days someone posted the source code for Melissa on a Web site, and now you're getting people who have copied that and made variations," said Weafer.
Graham Cluley, senior technology consultant for Sophos Anti-Virus, said viruses are spreading much more quickly because of e-mail.
"The reason why they're spreading more quickly is because of increased use of the Internet, and an increase in the number of viruses that are 'e-mail aware,'" said Cluley.
He said while the virus has been reported in Europe, Australia and the United States, it is not yet widespread.
Melissa, the creation of a New Jersey computer programmer, clogged e-mail systems at companies as far away as China, but it did no permanent damage.
Most viruses fail to spread
Dan Schrader, vice president of new technology at Trend Micro Inc., said that while 300 new viruses are created monthly, the vast majority never reach the public.
"There are about 400 viruses that have made it out to the real world. This one has, but not very far. ... If you do get infected by it, it is going to try to open up your address book and send copies of itself, so it has a potential to spread very quickly," said Schrader, who added that he did not consider the virus a significant threat.
He said the virus takes steps to hide itself, such as disabling a Macros warning included in Word, which would normally ask a user to "OK" opening up a Word document that included Macros.
This is just the latest virus slated to activate on Christmas. Over the summer, virus experts discovered another Windows virus set to activate Dec. 25, known either as Win32.Kriz, Win32Kriz.3740 or Win32.Kriz.3862. The virus is similar to the Chernobyl virus, which struck users in Europe and Asia earlier this year.
Win32.Kriz can corrupt files that are opened, copied and moved. It is also programmed to destroy a computer's flash BIOS, using the same routine as found in the Chernobyl virus, according to researchers. In that cases, users will be unable to boot their computers properly or control the cursor.