Sars virus exploited by worm writers

A new worm being distributed over the Web exploits people's fears about the outbreak of Sars, a killer flu from the Far East

Increasingly virus writes have been relying upon a topical hook in an attempt to encourage recipients to launch the virus -- whether it be concealed in an email purporting to offer nude pictures of female celebrities or exclusive spy pictures of Iraq.

In this instance an email arrives offering information about the spread of Severe Acute Respiratory Syndrome (Sars), which has killed dozens of people worldwide. Called W32/Coronex the mass-mailing worm will infect the recipient's machine once activated and will email itself to every name in the infected machine's email address book.

The Coronex worm uses a variety of subject lines, message bodies and attachment names to entice users into clicking including "Severe Acute Respiratory Syndrome", "SARS Virus" and Hongkong.exe. Hong Kong is believed to be the epicentre of the outbreak.

Graham Cluley, senior technology consultant for Sophos Anti-Virus, said: "The worm has been deliberately coded to exploit the public's genuine concern about Sars, and is just a further demonstration of the ways that virus writers attempt to use psychological trickery to spread their creations.

As ever the advice is to be careful and to practice great caution when dealing with any files received over email.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section.

Let the editors know what you think in the Mailroom.