A malicious program that masquerades as a Web page or HTML e-mail has dire consequences for those who fall for its ruse, antivirus experts said this week.
Known as Trojan.Offensive, the program takes advantage of a 10-month-old flaw in Microsoft's version of the Java Virtual Machine to overwrite critical system settings--called the registry--leaving Windows computers unusable. The operating system on the victimized PC must be reinstalled or repaired through an arduous process. "No data loss actually occurs, but the computer is basically hosed," said Craig Schmugar, a virus researcher for Network Associates.
The Trojan horse arrives in an e-mail message and appears to be an HTML document with a single hyperlinked word: "Start." Recipients of the e-mail who click the link, however, will cause a JavaScript program to run; that program will take advantage of a flaw in Microsoft's Java Virtual Machine to modify the system's registry. The flaw affects all versions of Windows running Microsoft's Internet Explorer 3.0 to 5.5sp1. By changing almost 50 registry values, the malicious program disables all programs, prevents Windows from being shut down, and makes icons on the Windows desktop disappear. Because no programs will run--not even antivirus scanners--the Windows operating system on the PC cannot be automatically repaired. While truly irksome, the program is not widespread.
|