New Virus Disguised as a Download of Internet Explorer 7 Beta 2

    The new virus spreads when the user clicks on a link recieved in the mailbox. The virus is hard to detect because it is not attached to the body message, and it is harder to stop it from reaching in-boxes. Disguised as a download of Internet Explorer 7 Beta 2, the virus is being hosted on several servers around the world, which will increase the time it takes to identify and clean them all.

    Mikko Hypponen, chief research officer at F-Secure, stated: "The idea of sending a link seems to be a trend among attackers; it's still fairly new and it works much better than sending a file."

    In addition Graham Cluley, a senior technology consultant for Sophos, said that the file is actually a new virus called Virus.Win32.Grum.A, and security experts are still analysing it to see what it does. Sophos said it can spread by e-mailing itself to contacts in a user's address book. The virus tampers with registry files to ensure it gets installed, and it tries to download additional files from the Internet. "I wouldn't classify this as one of the biggest viruses of the year, but that doesn't mean it isn't a threat", Cluley said.

Other details about the virus are not known yet, but usualy this type of viruses install a keystroke logger to steal personal information, and establish a network of infected computers to launch a denial of service attack. "We don't know anything yet about where it is coming from. It's fairly well made and hard to analyse with normal tools." Hypponen said.

The final version of IE 7 was released last October, so Microsoft is unlikely to be advertising a beta of the product. Users can download a real version of the software at Microsoft's Internet Explorer home page. A Microsoft spokeswoman said: "Microsoft is aware of this issue and is currently investigating this matter, including customer impact."

    The virus is being hosted on several servers around the world, servers that in appearence have been hacked, Hypponen said. The SANS Internet Storm Center asked administrators to check their logs to make sure they are not hosting the file. F-Secure and Sophos are blocking the virus and all major vendors are likely to do so soon. Some email filtering systems were also not blocking the virus.