Outbreak of viruses disguised as vaccines
Dangerous V3 update
Computer virus writers are disguising viruses as anti-virus updates in an attempt to trick users into running malicious code.
Korean security firm, Dr. Ahn's Laboratories, has warned its users about a malicious program that arrives by email disguised an update to its anti-virus software, V3. In reality the message contains an attachment, "V3update.com", which, if opened , can wipe a victim's hard drive.
The infected message appears to be sent from Ilchi.net, though the firm says it never dispatched such an email.
According to reports in the Korean Herald, a national police cyber investigation team is currently investigating the cases.
Dr. Ahn's said there have been cases where malicious software was posted to data exchange platform disguised as V3. However, this is the first time a users have received such a program by email.
The technique of disguising malicious code as security software was also used against an American software security firm, Central Command, last week.
Following the discovery of the spread of an internet worm, called I-Worm.XTC, which masquerades as a virus protection update, Central Command was forced to issue a security advisor to its customers and partners.
The worm, which infects Windows 95/98/Me/NT/2000 computers, has a spoofed email address so that to a casual observer it appears to come from Central Command. It uses the temporary internet files folder to search through cached pages for e-mail addresses, unlike most such viruses which use the Outlook address book. I-Worm.XTC can also be remotely controlled through Internet Relay Chat.
Graham Cluley, senior technology consultant at Sophos, said that both the Korean case and what happened with Command Software showed that, whilst it is not a new technique, virus writers are disguising their work as security software to get users to run it and in an "attempt to discredit antivirus companies".
Cluley added that downloading antivirus software from websites or using CDs for updates is more secure and should be preferred to obtaining software updates by email. ®