Antivirus software vendor F-Secure announced that it has received a sample of the first virus written specifically to operate under Microsoft's forthcoming Windows 2000 operating system.
Known as Win2K.Inta or Win2000.Install, F-Secure does not consider the virus to be a big threat, however, since it has received no reports that the virus is "in the wild," meaning that it has not yet been discovered outside of controlled environments, says Mikko Hyppönen, manager of antivirus research at the Espoo, Finland company.
The virus operates only under Windows 2000 and is not designed to function at all under older versions of Windows. Microsoft is scheduled to start commercial shipments of the new operating system by mid-February.
"The interesting thing is that it already exists, not that it is a big threat," Hyppönen says. "It will probably not have much of a life-span in the real world since ours, as well as other antivirus software programs, already can handle it."
From now on however, most new viruses are likely to include compatibility with Windows 2000, Hyppönen adds. "Windows 2000 will be a widely-used operating system, and virus writers target the widest possible reach."
F-Secure received a sample of the virus via an anonymous e-mail, as did several other leading antivirus software vendors, Hyppönen says.
The virus was probably written by a known, international group of virus writers called the 29A virus group, he says. "It is the first Windows 2000 virus, so I think they are mainly after the media attention - they want their five minutes of fame."
Win2K.Inta works by infecting program files and spreads from one computer to another when these files are exchanged. Once infected, the files do not grow in size, according to F-Secure, and the virus is capable of infecting files with the following extensions: EXE, COM, DLL, ACM, AX, CNV, CPL, DRV, MPD, OCX, PCI, SCR, SYS, TSP, TLB, VWP, WPC and MSI.
This list includes several classes of programs that to date have not been susceptible to virus infection, F-Secure says. For example, this virus will analyze Microsoft Windows Installer files, scan them for embedded programs and infect them, the company says.
The virus contains this text string, which is never displayed: ( Win2000.Installer) by Benny/29A & Darkman/29A, according to F-Secure. Further information about the virus can be found at: http://www.F-Secure.com/virus-info/v-pics/.
Formerly known as Data Fellows, the software company was founded in 1988 and late last year changed its name to F-Secure. Its North American headquarters are in San Jose.
F-Secure, in Espoo, Finland, can contacted at +358-9-8599-0688, or at www.f-secure.com/.
RELATED LINKS
More on how this virus works
from F-Secure
F-Secure Computer Virus Info Center
with up-to-date information on new viruses and hoax alerts
Buzz roundtable: Windows 2000
Read how Network World columnists deflate Windows 2000 hype
Network World Fusion, 9/27/99.
RELATED LINKS
