Napster-type services threatened by virus

A new type of virus has been discovered which affects machines on the ever-growing network of file sharing systems such as Gnutella and Napster.

The worm, known as Mandragore, which currently only infects users of the Gnutella system including those using software clients such as BearShare and ToadNode to access it, spreads by posing as another machine or node containing files that a user might want to download.

Mikko Hypponen, research manager at antivirus company F-Secure, said that when a user searches for files, such as 'butterflies', the infected node will announce it has a file available called 'butterflies.exe'. "If the user downloads and clicks on this file, his machine becomes infected and will start to offer infected files to other users," he said.

The rate at which the virus spreads is restricted because infected nodes quickly become overwhelmed and unable to answer all requests resulting in false replies to user queries. The worm does not contain a malicious payload and may possibly be just a proof of concept virus, as all it does is replicate itself across machines.

An advisory from F-Secure said the easiest way to avoid infection is simply not to download .exe files from Gnutella. Some Gnutella clients, such as BearShare, automatically hide search results with the .exe extension to prevent users from downloading malicious code.

Gnutella-based worms first started appearing last summer in the form of Visual Basic script viruses such as VBS/GWV, and are few and far between.

VBS/GWV spreads by spawning copies of itself on an infected machine under titles such as 'Pamela Anderson movie listing.vbs' or 'Battlefield Earth.vbs'.

The concept is the same as that which saw the spread of the Anna Kournikova virus - users downloading files that appear to be images or music files, but in reality are malicious executable programs.