BS: Computer virus exploits SARS fears

Subject: BS: Computer virus exploits SARS fears
From: katlaughing
Date: 23 Apr 03 - 04:25 PM

Watch out for email with a subject line about an update on SARS - it is a low-level computer virus which officials says plays on the fears of people. Here's a small blurb:

Officially called I-Worm Coronex (Kaspersky), the virus arrives disguised as a bulletin regarding SARS. The worm searches for e-mail addresses in the Windows Address Book and, using its own built-in mail program, sends itself to randomly selected recipients. It then changes the start page of Internet Explorer to the World Health Organization's Web page describing the SARS outbreak, by modifying a value in the registry key.

It affects most versions of Windows, including Windows 95, 98, NT, 2000, XP and Me, and does not affect Macintosh, OS/2, UNIX or Linux systems.

The virus first hit on Monday, April 21. Most security companies added the virus to their definitions list the next day. Antivirus programs protect computers by using these definitions lists, and all owners of virus programs have been urged to update their lists as soon as possible.

Infected computers must remove the virus manually and erase a registry key. Symantec offers full instructions at its Web site.

"This new worm is currently not as harmful or wide spread as top level threats Nimda, Klez or Slammer," Global Hauri CEO Eric Kwon said, "but it manipulates people by using a common psychological reaction to a very real biological health threat. We recommend computer users to run their antivirus software to disinfect the worm."

The e-mail arrives with one of the following in its subject field: "SARS," "I need your help," "SARS Virus," "honk kong," "Virus Alert," "bye" and "deaths virus."

The attached worm goes by several names, including sars.exe, corona.exe, virus.exe, hongkong.exe, deaths.exe, sars2.exe and cv.exe.

Subject: RE: BS: Computer virus exploits SARS fears
From: Little Hawk
Date: 23 Apr 03 - 07:59 PM

It figures...

They should start a "Saddam Found!!!" virus too, while the idea is still marketable.

Subject: RE: BS: Computer virus exploits SARS fears
From: GUEST,pdc
Date: 23 Apr 03 - 11:13 PM

Good stuff -- thanks for the information.