New e-mail worm exploits SARS anxiety

In the latest example of computer virus writers capitalizing on current events, a new e-mail worm uses fears about SARS (Severe Acute Respiratory Syndrome) to entice users into opening a file attachment, infecting host machines and helping spread the virus to other machines on the Internet.

The worm, W32/Coronex-A (Coronex), is a mass-mailer worm that uses Microsoft Corp.'s Outlook e-mail application to send copies of itself to unsuspecting recipients, according to an alert from antivirus company Sophos PLC.

Coronex arrives as an attachment in e-mail messages that carry a variety of subject lines and messages relating to the deadly new respiratory illness that has turned up in Asia, North America, and Europe. Greetings such as "SARS Virus," "I need your help," and "deaths virus," accompany messages containing the virus, according to antivirus software company Symantec Corp.

Attachments containing the virus with names like "sars.exe," "Hongkong.exe," and "deaths.exe" also play into media reports of the illness, which is concentrated in Asia, Sophos said.

When opened, the attachment launches the virus, displaying a pop-up window with the message "corona virus."

The Coronex virus modifies the Windows registry, adding an entry to ensure that it is launched whenever Windows starts, changing the start page for the Internet Explorer Web browser and deriving the location of the Windows Address book.

With the addresses in the Windows Address book, Coronex uses its own built-in SMTP (Simple Mail Transfer Protocol) engine to send copies of itself to the addresses. Sender addresses for those e-mail messages include sars@hotmail.com, corona@hotmail.com and deaths@china.com, Symantec said.

Coronex is just the latest in a string of worms and viruses that use widespread interest in current events or celebrities as a subtle enticement to open infected attachments that e-mail recipients would otherwise be wary of, according to Chris Belthoff, senior product marketing manager at Sophos in the U.S.

In March, the Ganda e-mail worm played on the pending war in Iraq to get users to open attachments that, it was claimed, contained spy photographs or pro-U.S. patriotic images.

Researchers at Sophos' virus labs in the U.K. identified the new worm Wednesday morning. So far, however, there have been no reports of infections from Coronex among Sophos' customers, Belthoff said.

Sophos, Symantec and McAfee all rated Coronex as a low threat and offered update virus definitions to detect the new worm.

Despite the psychological enticements and so-called "social engineering" used by Coronex's author, the chances of the new worm spreading are low, especially because it relies on human interaction to spread itself, Belthoff said.

A bigger threat might come from potential confusion between news reports of the new computer virus and the biological virus that is currently spreading worldwide, he said.

"It's something to pay special attention to," Belthoff said. "If the public sees information on the Web about the 'SARS virus,' meaning the Coronex computer virus, that could cause some people to panic or create a false sense of concern."

Antivirus companies should be particularly careful to refer to the new computer virus by its proper name, 'Coronex,' rather than referring to it by its theme, the SARS virus, Belthoff said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul Roberts

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?