Friendly neighborhood public service announcement - W32/Coronex-A worm

Just as an FYI: There's a new computer worm on the prowl that takes advantage of concerns about SARS to get people to open e-mail attachments, thus infecting their system. As always, the best rule of thumb is to not open e-mail attachments, even if you think you know who it's from.

Anyway, here are the details, courtesy of the Sidney Morning Herald.

Anti-virus software maker Sophos has issued a warning about a new computer worm that takes advantage of the worldwide concern over the virus causing Severe Acute Respiratory Syndrome (SARS).

The mass-mailing worm, which has been named W32/Coronex-A, sends itself to all contacts in Outlook address books and attempts to dupe innocent computer users into opening an attachment offering details on the current SARS epidemic.

The worm uses different subject lines, message bodies and attachment names to try and lure users into opening the attachments, including: "Severe Acute Respiratory Syndrome", "SARS Virus" and Hongkong.exe

Paul Ducklin, head of technology for Sophos in the Asia-Pacific, said the worm had no destructive payload. "The first time the worm is run, it shows a message with the text "SARS Virus, corona virus", and then copies itself to the Windows folder as Corona.exe. It then creates a registry entry so that corona.exe is run automatically each time Windows is started," he said.

"Every time it runs, it sends mail to everybody in your Outlook address book."