Antivirus company ranks "Thursday virus" a threat
Network Associates raises its threat rating for a new virus after it mysteriously spread rapidly across several banks in the last day, although other antivirus companies say the virus isn't out of the ordinary.
- Shankland covered the tech industry for more than 25 years and was a science writer for five years before that. He has deep expertise in microprocessors, digital photography, computer hardware and software, internet standards, web technology, and more.
The "Thursday" virus emerged more than a week ago, but its spread rate jumped dramatically in the last 24 hours, said Allison Taylor, a marketing manager at Network Associates. Of the 5,000 or so computers so far infected, more than half were at financial institutions, Taylor said.
If left untreated, the virus will delete all files on a Windows computer's C: drive on December 13, she said. The name "Thursday" came from the letters "Thus," which appear in the virus code.
The virus, written in the "macro" programming language that can automate Microsoft Word tasks, spreads from one document to another, but doesn't actively send itself to new computers. It infects computers running Office 97 and Office 2000. The virus can't damage Macintosh files, though it can infect and spread from Word files on the Macintosh, Network Associates said.
It's unclear why exactly banks were affected, Taylor said, except that one possible reason is "they swap a lot of data and they work continually." The surge could have resulted from end-of-month reports being shared widely, she said.
Network Associates' competitors, however, pounced on the announcement, saying that their software found the virus automatically and that the virus wasn't that big a of deal.
"This is nothing very exciting," said Symantec Antivirus chief researcher Carey Nachenberg. Only one Symantec customer has reported infection, he said.
And TrendMicro's Dan Schrader said his software's "heuristic" detection mechanism found "Thursday" without trouble, even though the particular virus hadn't been seen before. "Thursday" is dangerous, but routine, he said. His company probably finds about 20 similar viruses a month.