Donut virus highlights holes in .Net
Proof of concept, low risk
Virus authors have created what is believed to be the first malicious code to targets Microsoft's .Net web services architecture.
The Donut virus is written primarily in Win32 assembly and some MSIL (Microsoft Intermediate Language), infects other .NET executables using the .EXE extension. Donut was sent to antivirus vendors by its author, who is believed to be a Czech member of the 29/A virus writing group.
Due to the uncommon system requirements and replicating environment, the virus is unlikely to become widespread, so antivirus vendors are treating it as a low risk threat.
The .NET architecture must be installed on Windows2000/XP in order for the virus to function and it only infects some files. Donut is not designed to spread by email and the only threat arises if someone saves an infected file on a PC.
However experts say emergence of the "proof of concept" virus means the industry needs to invest in changing the way antivirus software works and adapt it to new environments.
"This virus proves that virus authors will continue to target new platforms, so antivirus vendors need to invest in research and work out better ways to detect threats," Jack Clark, product marketing manager for the McAfee division of Network Associates, said. ®
External links
Description of the virus by McAfee
Related stories
.Net may lead to fewer viruses
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM Implementer’s Checklist
Steps to Take Before Choosing a Business Continuity Partner
