Anti-virus software developer warns of web site born worm

Published July 3rd, 2000 - 02:00 GMT

Kaspersky Lab, a Russian anti-virus software development company, warned in a press release on Monday of a new Internet-worm "Jer," which has an ability to penetrate computers at the moment users visit infected web pages. 

"The worm is not so dangerous compared to such deplorably known monsters as "Chernobyl" or "Melissa," the firm said in the press release. 

The "Jer" virus, meanwhile, does not spread e-mail, but it has some errors that enable a spreading routine using IRC channels. 

"If there were not such primitive, errors the world would face yet another global epidemic comparable to 'LoveLetter'," warned Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Lab. 

"However, the appearance of this worm demonstrates the new technology of 'promoting' viruses on the Internet. Firstly, the virus is placed on a web site. Then its owner carries out an aggressive promotional campaign to attract more users to this site. This has an eye to at least several dozens of many thousands of new visitors, who will pass the virus on to their computers," he added. 

The "Jer" worm uses a primitive, but very effective way of penetrating computers. A web site contains a script-program -- the worm itself -- which is automatically executed after a user opens an infected HTML page. Then a user receives a warning from the system whether to accept this unknown script or not. This method exploits so-called "mind breaches." To avoid this annoying message a user will answer "yes." 

Right after this moment, the worm will be passed on to the computer. 

This is exactly the same way on July 2 the "Jer" author placed the worm on a web site within the Geocities community. It had an inviting title saying: "<< THE 40 WAYS WOMEN FAIL IN BED." Then he announced the web site on several popular IRC channels, attracting more than 1000 visitors on the very first day. 

Protection against the "Jer" worm has already been added to the upcoming daily update of AntiViral Toolkit Pro (AVP). 

Further details of the Jer worm can be found on Kaspersky's Web site at http://www.kasperskylab.ru/eng/news/press/20000702-1.asp -- (Abawaba.com)

© 2000 Al Bawaba (www.albawaba.com)

You may also like