Symantec detects first Java virus

The Symantec AntiVirus Research Center (SARC) claims to have found the first known Java virus on the Internet. However, users surfing the Web using either Netscape Navigator or Microsoft Internet Explorer are not believed to be at risk.

The virus - dubbed Strange Brew by SARC - was found by Symantec's Web-spider Seeker system. Carey Nachenberg, chief researcher at SARC, told Silicon News: "The virus can affect Java applications and applets, but if you try to download it from the Web, it will be destroyed by your Web browser."

The only threat, according to Symantec, is to Java application developers. The virus may affect developer files ending in '.class', but because the virus is parasitic, most host programs would continue to function even after infection.

Nachenberg explained: "These files are programs which contain data and some logic. They are divided into a number of sections: each one contains some logic. The virus gains control by searching in the directory for other '.class' files eligible for corruption and reproduces itself. The reproduced virus then tacks on to other '.class' files."

Although there is little danger to end users, Strange Brew is significant because it operates - like Java - across platforms, making infection possible on many different architectures.

Symantec said it will post a fix, as part of an add-on to its Norton AntiVirus product, on its Web site some time today.