Fast-spreading virus plagues New Zealand net users

6:00 pm - By MICHAEL FOREMAN

A computer virus that is propagating as quickly as any yet known has made its presence felt in New Zealand.

The "mass mailer worm" BadTrans.B has infected thousands of PCs around the world and has replaced Sircam as the most virulent worm in circulation.

"Its rife," said Alan Candy, managing of director of Auckland-based anti virus specialist Applied Insight.

Mr Candy had received two copies of the virus in his email today and he knew of several businesses whose PCs had been infected by it.

"This one has some features that allow it to spread a little easier than the others," he said.

BadTrans is carried as an attachment in email messages, but unlike most viruses it can be activated without the user opening that attachment.

"It exploits a known problem with Outlook Express version 5, which allows it to automatically launch itself," Mr Candy explained.

"Normally you have to open an attachment for a virus to infect your PC but with this one you only have to select it by clicking on the preview pane, and then it executes."

The virus has been received by many members of the auction site Trade Me, with one user complaining that she had been sent 53 copies mostly from other trademe users.

"It looks like the Trade Me community is experiencing an epidemic of infections," complained another user on the websites discussion board.

Once it is activated, BadTrans searches for email addresses in the users address book, but it also scours records of websites recently visited and stored documents for its next targets.

The virus also installs a small spyware program which records keystrokes that may be used to enter passwords.

While it was difficult to assess the real risk of losing passwords in this way, Mr Candy believed it was a sign that the "anti-social component" of
viruses seemed to be increasing.

"Recently Sircam, which sent copies of your documents to your contacts, could be very embarrassing and the Magistrate worm deleted the contents of hard drive after laying dormant for one month. Back in the old days very few viruses would be this nasty."

While it is fast-spreading, BadTrans is easily detected and removed by anti-virus software that has been recently updated with the latest viral definitions.

The bug in versions 5.1 and 5.5 of Microsoft Internet Explorer which causes the auto-execution vulnerability may also be cured by downloading a patch from Microsoft's website