New Trojan in the wild

The government's Unified Incident Reporting and Alert Scheme (UNIRAS) has warned antivirus companies that a new Trojan is on the loose.

'Mystri-A' uses a relatively simple monitoring program that tracks all traffic from port 6000 and sends it to an unknown email address.

The information is stored in c:\logfile.txt before sending, and the Trojan copies itself to systrimit.exe. A virus identification file is available from most vendors.

"We've seen virtually no activity since the government alert," said Graham Cluley, antivirus specialist at Sophos.

"A large company reported seeing it, however, and we've made sure there's a virus signature and removal utility available. We are watching the situation closely."

UNIRAS was set up in 1992 to monitor, analyse and report on IT security issues. It is part of the National Infrastructure Security Co-ordination Centre.

Another new virus - SoBig D - has made an appearance, but currently is having little impact. The worm is a minor variant of the SoBig malware that has already been identified in the wild, but seems to be infecting a very low numbers of users.