Virus exploits terror attacks

Everyone has an opinion about the attacks on New York

By BBC News Online technology correspondent Mark Ward

No matter how strong your feelings about the attacks on New York, do not open an e-mail inviting you to vote on what would be an appropriate response.

We find it appalling that someone would choose this time and these circumstances to propagate a virus

Jim Desler, Microsoft

Rather than holding a voting form, the message bears a destructive Windows virus.

Although not yet widespread, anti-virus companies are warning web users to be alert to the e-mail, which tries to spread by capitalising on the events in America on 11 September.

Despite its subject matter, the worm is thought to be created by an opportunist rather than any of the groups suspected of being behind the attacks on the World Trade Center.

Destructive program

"We find it appalling that someone would choose this time and these circumstances to propagate a virus," said Microsoft spokesman Jim Desler.

The e-mail bearing the worm has the subject line: "Fwd: Peace BeTween AmeriCa And Islam!"; and the body of the message reads: "Hi! IS iT A waR Against America Or IsLam! Let's Vote To Live in Peace!".

It also changes web pages in infected machines to read: "AmeRiCa...Few Days WiLL Show You What We Can Do!!! It's Our Turn ZaCjEr is So Sorry For You".

The idiosyncratic use of upper and lower case letters, and flagrant abuse of grammar is typical of the writing style of many hacker wannabes known derisively as "script kiddies".

Plunders e-mail addresses

The malicious program, which has been dubbed the Vote virus, affects only Microsoft Windows.

Those opening the mail will launch a destructive program that plunders the address book of Microsoft's Outlook program to generate a new list of places to send itself. The virus also tries to delete key system files.

The Vote virus could cause problems for infected companies by overloading e-mail servers with the sheer volume of messages it generates.

However, so far, it does not seem to be infecting many computers. The loopholes that it exploits have been targeted before by a wave of similar viruses that have struck at intervals over the last year.

Most companies have installed security patches to close these loopholes before now so the vast majority of computers are likely to avoid infection.

Daily counts of the viruses passing through UK networks by anti-virus company Message Labs show that so far the Vote virus has not shown up at all. The top virus is the Sircam Windows worm that steals files.