MTX virus gaining speed in unusual ways

From...

by Ashlee Vance

(IDG) -- The 3-month-old MTX virus appears to be gaining speed, with several anti-virus vendors escalating the pesky bug to a medium-level threat in recent weeks. The increased worries stem from a particularly harmful feature in which the virus blocks users from anti-virus Web sites, stopping them from downloading virus protection updates and from issuing warnings.

Michael Callahan, director of product marketing at McAfee, a division of Santa Clara, Calif.-based Network Associates, said MTX first appeared in late August, originating in Germany. At the time of its discovery, McAfee's Anti-Virus Emergency Response Team (AVERT) labeled the virus a low threat, but McAfee upgraded it to the medium level after about 32 users reported an MTX attack.

MORE COMPUTING INTELLIGENCE

IDG.net home page

InfoWorld home page

InfoWorld forums home page

InfoWorld Test Center

How to protect yourself from viruses

Reviews & in-depth info at IDG.net

E-BusinessWorld

TechInformer

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletter for IT leaders

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

"We made it a medium threat about two to three weeks ago as we see the number of samples increasing," Callahan said. "Mostly we see corporate users being hit."

The virus proves troublesome by changing its subject header and attachment file names and by blocking users from anti-virus vendors' Web sites. MTX spreads via a user's Microsoft Outlook applications with varying attachment names, such as Bill_Gates_piece.jpg.pif, I_am_Sorry.doc.pif, Internet_Security_Forum.doc.pif, and New_Playboy_Screen_Saver.scr. When a user clicks on one of these attached files, the virus begins spreading its evil ways.

Besides coming up with catchy attachment names, the author of MTX made sure that many of the best-known anti-virus vendors' Web sites became inaccessible to users once they launched the devious files. McAfee.com, Symantec, and Sophos all had parts of their sites blocked from users along with a number of other vendors. For Network Associates' McAfee division, however, users could still access the AVERT lab's Web site and McAfee's corporate virus protection site.

McAfee will continue to monitor the virus but does not see it as a major threat just yet.

"If people don't have up-to-date DAT protection as it starts to spread, it could spread a little bit faster," Callahan said. "But people are paying more attention to keeping DAT files up to date these days."

'Navidad' computer virus poses moderate risk
November 10, 2000
Company scans for viruses targeting PDAs, WAP devices
November 3, 2000
Experts predict more mutating viruses
October 31, 2000
Variant of 'I Love You' virus returns
October 24, 2000
How a computer virus works
October 23, 2000

Low-risk Internet worm making the rounds
(IDG.net)
Office 2000 gets its own virus protection
(PC World)
Three minutes with 'Doctor Owl,' virus writer
(PC World)
Bugs and fixes
(PC World)
How to protect yourself from viruses
(PC World)
An investigation of the Love Bug virus
(PC World)
Experts predict more mutating viruses
(NW Fusion)
Buying security
(NW Fusion)

AVERT
McAfee Corp
Network Associates, Inc

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.