New virus hides behind old technology
Published: 06 Sep 2000 08:02 BST
A new virus from the Czech Republic has anti-virus software makers rushing to analyse the ability of so-called "files streams" to infect PCs.
File streams -- not to be confused with audio and video streaming à la RealNetworks -- break programs up into a main code segment, or stream, and several alternate ones. Used for sharing data between programs, Microsoft's Windows NT technology first debuted in the Windows NT file system, or NTFS, but is also present in Windows 2000.
Eugene Kaspersky, the head of the Russian anti-virus research company Kaspersky Lab and the first to spotlight the Stream virus, theorised that hiding malicious code in a file stream would make it harder to detect. "Certainly, this virus begins a new era in computer virus creation," Kaspersky said in a statement from Moscow. "The 'Stream Companion' technology the virus uses to plant itself into files makes its detection and disinfection extremely difficult to complete."
Most anti-virus scanners only scan the main stream of each program and could miss data hiding in an alternate data stream, Kaspersky said.
But others derided Kaspersky's announcement as thinly veiled hype. "They have not proven anything here except that they can write data to an alternate data stream," said Russ Cooper, editor of Windows NT security watcher NTBugtraq.com, who moderated a discussion of the possible dangers posed by alternate data streams in 1997. That discussion concluded there was very little danger posed by the exploitation of the file streams system.
"This is highly theoretical and not all that new," said Cooper, who pointed out that to infect a computer, the virus would have to infect the main stream of the program. That would make it visible to current anti-virus programs.
The virus, created by two writers using the names Benny/29A and Ratter, does little else except infect files and it doesn't do that very well either, said Patrick Martin, product manager for Symantec's anti-virus research labs. Users should not worry about the virus attacking their computers. "This is a proof of concept," he said. "This virus is not going anywhere. It is not in the wild."
Take me to the Virus Workshop
What do you think? Tell the Mailroom. And read what others have said.
Did you find this article useful?
49 out of 121 people found this useful
- Share this article:
