A worm capitalising on the widespread fear accompanying the fatal flu virus Severe Acute Respiratory Syndrome (Sars) has emerged in the wild, antivirus experts warned yesterday.
However, according to antivirus company Sophos, the impact of the internet virus is minimal.
"Sophos has received no reports from users affected by this worm. However, we have issued this advisory following enquiries to our support department from customers," the company said in a statement.
The W32/Coronex-A mass-mailer internet worm, which sends itself to every contact in a victim's Windows address book, is contained in an attachment to emails that are being distributed via different addresses, including [email protected], [email protected] and [email protected], depending on the day they are sent out.
When first run, the worm displays a message box with the text 'SARS Virus, corona virus'. It then copies itself to the Windows folder as corona.exe, and creates the following registry entry so that corona.exe is run automatically each time Windows is started: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PC-Config32 = %WINDOWS%\corona.exe-A.
The worm copies itself to the C:\My Downloads folder using one of the 24 file names listed below, depending upon the hour of the day:
Age Of Mythology.exe
Battlefield 1942 (full).exe
Black Hawk Down (full).exe
Command & Conquer: Generals.exe
Cossacks Full Version.exe
Dark Age of Camelot.exe
Grand Theft Auto 3 (full).exe
Jedi Knight II.exe
Master Of Orion 3.exe
Medel Of Honor: Allied Assault.exe
Quake 3 Full Version.exe
Rainbow 6 Full.exe
Return to Castle Wolfenstien (full).exe
The Lord of the Rings.exe
The Sims: Unleashed.exe
Tribes 2 (full).exe
Unreal 2: The Awakening (full).exe
Warcraft III Full.exe
White and Black.exe
When run with a -A command line switch (at start-up, for instance), the worm runs continuously in the background and emails itself at one minute past any hour.
The worm also changes the start page for Microsoft Internet Explorer by setting the registry entry HKCU\Software\Microsoft\Internet Explorer\Main\Start Page= http://www.who.int/csr/don/2003_04_19/en.
Addison Lee is working on autonomous taxis for commuting and pleasure
IBM and Technical University of Munich team demonstrate how Shor's algorithm, which can't be cracked by conventional computers, can be solved quickly with quantum computing
Hubble Space Telescope finds superflares from young red dwarfs could strip away planetary atmosphere
Younger stars are 100 to 1,000 times more energetic than when they're older
Two of the big four supermarkets will use the system to control sales of restricted products