Sars virus exploited by worm writers

Increasingly virus writes have been relying upon a topical hook in an attempt to encourage recipients to launch the virus -- whether it be concealed in an email purporting to offer nude pictures of female celebrities or exclusive spy pictures of Iraq.

In this instance an email arrives offering information about the spread of Severe Acute Respiratory Syndrome (Sars), which has killed dozens of people worldwide. Called W32/Coronex the mass-mailing worm will infect the recipient's machine once activated and will email itself to every name in the infected machine's email address book.

The Coronex worm uses a variety of subject lines, message bodies and attachment names to entice users into clicking including "Severe Acute Respiratory Syndrome", "SARS Virus" and Hongkong.exe. Hong Kong is believed to be the epicentre of the outbreak.

Graham Cluley, senior technology consultant for Sophos Anti-Virus, said: "The worm has been deliberately coded to exploit the public's genuine concern about Sars, and is just a further demonstration of the ways that virus writers attempt to use psychological trickery to spread their creations.

As ever the advice is to be careful and to practice great caution when dealing with any files received over email.

Let the editors know what you think in the Mailroom.