New e-mail virus targets Windows, IE

A new e-mail-borne virus variously known as "Tanatos," and "W32/Bugbear," is being circulated as an e-mail attachment and appears to target machines running Microsoft Corp. operating systems, according to alerts issued by a number of computer security companies.

The virus file is attached to e-mails with a wide variety of subject lines such as "bad news," "Membership Confirmation," "Market Update Report," and "Your Gift," and appears to use randomly-generated names to avoid detection by antivirus software, as well as multiple file extensions to disguise the fact that it is an executable file, according to Vincent Gullotto, vice president of the McAfee AVERT (Anti-Virus Emergency Response Team) at Network Associates Inc.

Once activated, the virus shuts down scores of vital processes used by Windows and by antivirus software, records user keystrokes, opens a backdoor to the infected machine for use by attackers, and attempts to mail copies of itself out to other users, randomly generating new subject lines and virus executable names as it does, according to Gullotto.

Despite receiving numerous copies of the virus from customers and partners, however, antivirus researchers at AVERT have been unable to get the mail function of the virus to work, said Gullotto.

"All samples we've seen may not be the result of a mass mailing produced by someone launching the virus. We could just be witnessing the seeding of the virus, by the author, rather than evidence that it's working on other systems, " said Gullotto.

The new virus takes advantage of a known vulnerability in Microsoft's Internet Explorer versions 5.01 and 5.5 that allows attackers to embed malicious code in the header of an improperly formatted HTML message that could cause e-mail clients such as Outlook to automatically launch attached executable files.

Microsoft addressed the issue in Service Bulletin MS01-020 and issued a patch for the vulnerability in March of 2001.

The fact that the virus targets a known and patched vulnerability, coupled with its apparent inability to mail itself makes security experts such as Gullotto doubt that this new threat will spread too widely.

"At this point (AVERT) is rating this a medium risk. We don't expect it to be a big issue."

Still, Gullotto advises users of Internet Explorer to make sure that they have applied any available security patches. Users of Internet Explorer version 5 are particularly vulnerable to infection by Tanatos, he said -- especially if they are not blocking e-mail attachments.

And, as with all new viruses, the appearance of Tanatos points to the need for IT managers to take a hard look at vulnerabilites in their network infrastructure.

"People need to revisit their security policies and practices," said Gullotto.

"I know that it's a lot of work to stay on top of these patches -- Microsoft released 50 of them this year alone. But you have to weigh your risks--are you going to do nothing and wait for something to happen, or are you going to find a way to incorporate patching into your processes?"

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul Roberts

Computerworld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?