An ancient computer virus has infiltrated the latest fast spreading email scourge to create a nasty “double-infected” virus.
Anti-virus software makers say some versions of the widespread computer virus Klez.h hide a mutation of a very destructive virus first seen in 1998 and known as Chernobyl or CIH. The Chernobyl virus variant automatically infects files and programs files on computers running Microsoft Windows.
“Klez is just another Windows program,” says Graham Cluley of the UK anti-virus firm Sophos. “[CIH] just infects the executable file, whereupon Klez then forwards itself around in a double infected state.”
Chernobyl can cause permanent damage to some computers’ underlying system software, or BIOS (Basic Input/Output System). In some cases this can make the computer unusable. The original virus was programmed to activate on 26 April, the anniversary of the Chernobyl nuclear disaster. But the new variant – W95.CIH.1049 – triggers on 2 August.
Advertisement
Far and wide
Klez.h, on the other hand, does not cause permanent damage to a computer. But it has various tricks that have enabled it to spread itself far and wide. The virus comes in a number of different types that can disable anti-virus software, send emails with one of many possible subject lines and send genuine as well as infected email attachments.
Jack Clark, of another anti-virus company, Network Associates, says: “Klez is very infectious and CIH is very damaging. What you have in the end is a nasty piece of code.”
UK virus scanning company MessageLabs rates Klez.h as the third most common computer virus of all time. The company has intercepted more than 391,000 emails carrying the malicious program. Russian anti-virus company Kaspersky Labs reports that Klez.h was the busiest virus of April 2002 by far, accounting for 94 percent of all computer infections.
However, only a handful of these cross-infected viruses have so far been spotted “in the wild”, according to the anti-virus companies.
