A worm capitalising on the widespread fear accompanying the fatal flu virus Severe Acute Respiratory Syndrome (Sars) has emerged in the wild, antivirus experts warned yesterday.
However, according to antivirus company Sophos, the impact of the internet virus is minimal.
"Sophos has received no reports from users affected by this worm. However, we have issued this advisory following enquiries to our support department from customers," the company said in a statement.
The W32/Coronex-A mass-mailer internet worm, which sends itself to every contact in a victim's Windows address book, is contained in an attachment to emails that are being distributed via different addresses, including [email protected], [email protected] and [email protected], depending on the day they are sent out.
When first run, the worm displays a message box with the text 'SARS Virus, corona virus'. It then copies itself to the Windows folder as corona.exe, and creates the following registry entry so that corona.exe is run automatically each time Windows is started: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PC-Config32 = %WINDOWS%\corona.exe-A.
The worm copies itself to the C:\My Downloads folder using one of the 24 file names listed below, depending upon the hour of the day:
Age Of Mythology.exe
Battlefield 1942 (full).exe
Black Hawk Down (full).exe
Command & Conquer: Generals.exe
Cossacks Full Version.exe
Dark Age of Camelot.exe
Grand Theft Auto 3 (full).exe
Jedi Knight II.exe
Master Of Orion 3.exe
Medel Of Honor: Allied Assault.exe
Quake 3 Full Version.exe
Rainbow 6 Full.exe
Return to Castle Wolfenstien (full).exe
The Lord of the Rings.exe
The Sims: Unleashed.exe
Tribes 2 (full).exe
Unreal 2: The Awakening (full).exe
Warcraft III Full.exe
White and Black.exe
When run with a -A command line switch (at start-up, for instance), the worm runs continuously in the background and emails itself at one minute past any hour.
The worm also changes the start page for Microsoft Internet Explorer by setting the registry entry HKCU\Software\Microsoft\Internet Explorer\Main\Start Page= http://www.who.int/csr/don/2003_04_19/en.
Including a 15-inch Intel Core-powered device weighing less than a bag of sugar
Tuomo Suntola's ALD technology extended Moore's Law, but was only adopted by chip-makers in 2007
Trump proposes a $1.3bn fine and a round of firings to un-bork ZTE
Findings could mean new optical frequencies to transmit more data along optical cables