Budget 2001: A Primer

The worm acts as a superficial chameleon, taking the name of whichever filea person requests. Although its name changes, people who use the Gnutellanetwork can easily spot the worm by its constant size: 8,192 bytes. Thatmakes it unlikely that the virus will spread very quickly, said VincentGullotto, director of antivirus research at security software maker NetworkAssociates.

"Its ability to spread on a mass scale quickly is not going to be there," hesaid. "There's still going to have to be some kind of social engineeringinvolved in it." Gullotto said that Network Associates has had no reports ofthe worm from its customers as of Monday afternoon.

The worm appeared over the weekend, said Ben Houston, a student in computerscience at Carleton University who has been tracking the virus. As aproof-of-concept worm, it could open up peer-to-peer networks as anothervector for computer viruses to spread. Similar to viruses such as Hybris andHappy99, the Gnutella worm infects a PC and then monitors a computer'snetwork connection. Hybris and Happy99 watch for e-mail addresses; this wormlooks for Gnutella connections. When the PC's owner connects to the Gnutellanetwork, the worm looks for file requests-most commonly music files-andsends back a positive match. Other people will seemingly see the file theywant on the victim's computer for any request they send. The act of changingits form to fool potential victims makes the worm a Trojan horse. Forexample, searching for text that wouldn't normally be found in a song titlesuch as "imavirus" will find several files called imavirus.exe. Themechanism for infecting other computers-or at least convincing people todownload the worm-had been discussed in a security advisory posted to theBugtraq security list last May. In arrangement with India.CNET.com