'Donut' virus set to poke holes in .Net

From...

By Ashlee Vance
and Matt Berger

(IDG) -- A new virus that's the first to target Microsoft's .Net platform for building and deploying Web services has emerged, posing an early risk for the build-out of the next-generation Internet, according to an antivirus vendor.

Called "W32/Donut," the virus originated in the Czech Republic and targets files running in Microsoft's .Net Framework, the set of building blocks that are needed to create and execute XML Web services and other applications in Windows.

Windows XP Professional is Microsoft's first operating system release that will include support for the .Net Framework. It's also the central feature of Microsoft's Visual Studio .Net developer tool kit. Users who have the .Net software running on Windows 2000 or XP could be affected. Antivirus expert McAfee said, however, that even users with .Net applications face only a low risk of infection.

IDG.net INFOCENTER Computerworld main page Computerworld's topic-oriented communities Computerworld's IT career center Free daily newsletters Related IDG.net Stories Stand by for more nasty Web attacks in 2002 Antivirus expert: Microsoft design to blame for virus load ZaCker worm attacks security software Features PC World.com Product Finder Mastering e-commerce by degrees Fast-track training puts nontechies in IT jobs Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

Unlike most well-known viruses, Donut doesn't spread itself automatically via e-mail but must be mailed directly to a user or downloaded from a Web site. The program doesn't do damage to an infected PC, either. It simply infects other .Net files with its code and displays a dialog box with the message, "This cell has been infected by dotNET virus!" said Craig Schmugar, a virus researcher at McAfee's Antivirus Emergency Response Team (AVERT) Labs.

The dialog box appears only once in every 10 times an infected file is run.

The virus is a proof-of-concept program, letting Microsoft know that attackers are awaiting its new set of software and Web services, Schmugar said.

"It does not do a whole lot right now, but we will see a different type of virus down the road because of this," Schmugar said. "This is forward-looking, but it lets people know there will be attacks."

The .Net Framework includes Common Language Runtime, a developer tool that allows applications to be programmed in various developer languages. It also includes class libraries and other programming tools that enable developers to build XML Web services and execute those in Windows.

Two key pieces of the framework, Common Language Infrastructure and Microsoft's programming language C#, were approved as standards last month by the European Computer Manufacturers Association, a European standards body.

The virus was written primarily in Win32 assembly language and some Microsoft Intermediate Language, according to AVERT's Web site. The program attacks other .Net executables using the .EXE extension but doesn't stay resident in memory.