CNET también está disponible en español.

Ir a español

Don't show this again

Christmas Gift Guide
Internet

New virus can be detected

Internet users can expect a new virus to hit their computers next week, infecting hard drives and causing data loss.

A new virus is expected to hit Internet users' computers next week, infecting hard drives and causing data loss.

Virus watchers expect the "Hare Virus"--named for an attribution to Hare Krishna found in it--to hit on August 22 and September 22.

The Hare Virus is no Michelangelo, an earlier virus that attacked users' systems, although the concept is much the same. Theoretically, the virus lies dormant on a user's computer until its detonation dates of August and September 22. Any user who is unlucky enough to have acquired the virus--most widely propagated over seamy newsgroups such as alt.cracks and alt.sex-- and has not detected it, may have their hard drive wiped out.

"It's one of the nastiest viruses we've seen in a long time," said Alex Haddock, a product manager for Symantec.

The virus has been found internationally--or "in the wild," as virus experts put it--in Canada, New Zealand, the Netherlands, Africa, Switzerland, the United Kingdom, and Russia, as well as the United States. But other virus experts doubt that the virus will be widely destructive because the virus is so buggy that it will have trouble propagating.

One strain of the virus, which Haddock says originated in New Zealand, was found at the University of Auckland. It had infected one server and, from there, spread to several PCs linked to the network. Fortunately, university officials detected it, shut down the system, and called in Symantec, which found the virus and repaired the system.

The very fact that the virus was detected reveals its weakness, experts say. "For a virus to spread very well, it needs to do it in such a way that it does not tell you something's wrong," said Jimmy Kuo, director of antivirus research at McAfee. "This virus is not programmed very well and infected users will soon find out they are infected."

Joe Wells, who produces The WildList, a confirmed list of all-known wild viruses, agreed with Kuo. "It's so buggy and so obvious," he said. "Buggy viruses usually don't spread wide," But, he added, "there are exceptions."

Usually, the infected program will cause the computer to crash several times, and the user will probably toss out the offending program, explained Wolfgang Stiller, president of Stiller Research. Hare, he said, "tends to crash the computer so it can't spread." The virus is, however, very interesting, in that it is written cleverly enough that it at first eludes detection programs, he said. In sum, "it's a fairly low threat to the user community as a whole."

If your computer does have it, you can still get any number of virus detection programs to eliminate it, including ones by McAfee, Symantec and Stiller.

The virus, according to information at Symantec's Web site, is a "polymorphic, multipartite virus that infects .com and .exe files as well as master boot records (MBRs) on hard drives and boot sectors of floppy disks. Upon execution the virus will infect the MBR and go resident infecting any .com or .exe file that is executed."