New e-mail worm exploits Sars anxiety

News

New e-mail worm exploits Sars anxiety

An e-mail worm that uses fears about Sars (Severe Acute Respiratory Syndrome) to entice users into opening a file attachment, infecting host machines and helping spread the virus on the internet is on the loose.

The worm, W32/Coronex-A (Coronex), is a mass-mailer worm that uses Microsoft's Outlook e-mail application to send copies of itself to unsuspecting recipients, according to an alert from antivirus company Sophos.

Coronex arrives as an attachment in e-mail messages that carry a variety of subject lines and messages relating to the deadly new respiratory illness that has turned up in Asia, North America and Europe. Greetings such as "Sars Virus", "I need your help" and "deaths virus", accompany messages containing the virus, according to antivirus software company Symantec.

Attachments containing the virus with names like "sars.exe", "Hongkong.exe", and "deaths.exe" also play into media reports of the illness, Sophos said.

When opened, the attachment launches the virus, displaying a pop-up window with the message "corona virus".

The Coronex virus modifies the Windows registry, adding an entry to ensure that it is launched whenever Windows starts, changing the start page for the Internet Explorer web browser and deriving the location of the Windows Address book.

With the addresses in the Windows Address book, Coronex uses its own built-in SMTP (Simple Mail Transfer Protocol) engine to send copies of itself to the addresses. Sender addresses for those e-mail messages include sars@hotmail.com, corona@hotmail.com and deaths@china.com, Symantec said.

Coronex is just the latest in a string of worms and viruses that use widespread interest in current events or celebrities as an enticement to open infected attachments, according to Chris Belthoff, senior product marketing manager at Sophos.

In March, the Ganda e-mail worm played on the pending war in Iraq to get users to open attachments that, it was claimed, contained spy photographs or pro-US patriotic images.

Researchers at Sophos' virus labs in the UK identified the latest worm yesterday (23 April). So far, however, there have been no reports of infections from Coronex among Sophos' customers, Belthoff said.

Sophos, Symantec and McAfee all rated Coronex as a low threat and offered update virus definitions to detect the worm.

 


Email Alerts

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
 

COMMENTS powered by Disqus  //  Commenting policy