Donut virus highlights holes in .Net
Proof of concept, low risk
Posted in Anti-Virus, 10th January 2002 12:49 GMT
Free whitepaper – Avoiding 7 common mistakes of IT security compliance
Virus authors have created what is believed to be the first malicious code to targets Microsoft's .Net web services architecture.
The Donut virus is written primarily in Win32 assembly and some MSIL (Microsoft Intermediate Language), infects other .NET executables using the .EXE extension. Donut was sent to antivirus vendors by its author, who is believed to be a Czech member of the 29/A virus writing group.
Due to the uncommon system requirements and replicating environment, the virus is unlikely to become widespread, so antivirus vendors are treating it as a low risk threat.
The .NET architecture must be installed on Windows2000/XP in order for the virus to function and it only infects some files. Donut is not designed to spread by email and the only threat arises if someone saves an infected file on a PC.
However experts say emergence of the "proof of concept" virus means the industry needs to invest in changing the way antivirus software works and adapt it to new environments.
"This virus proves that virus authors will continue to target new platforms, so antivirus vendors need to invest in research and work out better ways to detect threats," Jack Clark, product marketing manager for the McAfee division of Network Associates, said. ®
External links
Description of the virus by McAfee
Related stories
Free whitepaper – Certify your software integrity with Thawte code signing certificates


The best practices guide for application security
Reducing messaging and web security costs with managed services
Avoiding 7 common mistakes of IT security compliance
Certify your software integrity with Thawte code signing certificates
The future of SaaS and IT infrastructure management
Feds: Hospital hacker's 'massive' DDoS averted
Microsoft knew of nasty IE bug a year before attacks
BlockMaster SafeStick hardware-encrypted USB drive