Virus alert: Two worms on the horizon

Anti-virus vendors have issued a warning to users about two viruses which have been reported in the wild.

Sophos has warned users about the W98/Elkern, which is an executable file virus designed to attack Windows 98 and ME. The KW32/Klez worm carries the W98/Elkern virus inside and drops and executes it when the programme is run. The worm can also send itself to all entries in user's address book.

According to Sophos, it arrives in an email with a variety of subject lines, such as "Hi, Hello, How are you?, Can you help me? We want peace, Where will you go? Congratulations!!!, Free XXX Pictures, A free hot porn site or Why don't you reply to me?".

The attachment has a random filename and the sender address is either a random uppercase name at yahoo.com, hotmail.com or sina.com, or one chosen from a list inside the virus. The company had seen several Elkern/Klez viruses in the wild by Monday morning.

Network Associates has urged users to be aware of the Antset worm, which tries to impersonate a security patch for the Ants Trojan horse reported earlier last month. The mass-mailing virus attempts to send itself to all users found in the Windows address book and email addresses found in the temporary web browser cache.

It arrives as an email with a subject line ANTS Version 3.0 with either German or English text.

The English version reads: "Attached you will find the brand new Version 3.0 of ANTS, the unique freeware trojan scanner. To install ANTS simply run the attached setup file."

The German version of the email reads: "Anhängend die neue Version 3.0 von ANTS, dem bislang einzigartigen kostenlosen Trojanerscanner. Zum installieren einfach die angefügte Datei ausführen.