Science: The Black Baron is bent on sabotage: Two new, highly destructive viruses that can change their appearance may have been created by someone in the software industry. Susan Watts reports

Click to follow
The Independent Online
Two new and 'highly dangerous' computer viruses have been spotted in the UK. Their author is apparently British and goes by the name 'the Black Baron'. The viruses are called Smeg. Pathogen and Smeg. Queeg, and take their names from the television series, Red Dwarf. 'Smeg' is an expletive used in the programme and 'Queeg' is a bossy computer persona. 'Smeg' also stands for Simulated Metamorphic Encryption Generator which produces viruses capable of changing their appearance many times, so that they take on a different character in every new computer file they infect. This makes detection more tricky, but not impossible.

S&S International, one of the UK's largest producers of anti-virus software, has described the new pair of viruses as 'the most complex we have ever seen'.

In the past 10 days, S&S has had 12 calls reporting infection, some from 'large institutions', including academic and business centres. Huddersfield University is also thought to have been hit.

When Smeg. Pathogen is triggered, it writes random rubbish over any data on the computer's hard disk and displays a lengthy message, part of which reads: 'Smoke me a kipper, I'll be back for breakfast . . . . Unfortunately some of you (sic) data won't]]]]' The virus also adds 100 to the year stored on the computer's date file.

Virus hunters believe the viruses were transmitted after being buried in anti-

virus software, usually designed to protect computer systems from such attacks. They think this was uploaded on to at least one bulletin board (an electronic message centre) from which the anti-

virus software spread the viruses it was harbouring over computer networks across the UK.

Graham Cluley of S&S said the worst aspects of the viruses are that they are so hard to spot and are now 'in the wild' so they can infect computers at random. 'People are not going to know they have one of them because they can lie dormant for so long,' he said.

Pathogen is set to trigger between 5pm and 6pm on Monday evenings, and Queeg between noon and 1pm on Sundays, but only if certain preconditions have been fulfilled. Jim Bates, a consultant for Virus Bulletin, writing in the May issue, said: 'The virus displays above-average programming skill, and some in- depth knowledge of anti-virus techniques. These facts, coupled with a very nasty trigger routine, make the writer one of the most destructive individuals whose work I have encountered.

'For someone to hate computing so much that they produce a virus like this is beyond belief. With the added suspicion that genuine anti-virus research was involved, the possibility of market manipulation becomes more real.'

This hint that the virus may have originated from someone interested in selling anti-virus software is played down by Mr Cluley: 'No anti-virus vendor worth his salt would do that.' In the past week, S&S has written the first piece of software capable of spotting the new viruses.

Mr Bates advocates serious punishment for the perpetrator of this latest virus outbreak, but concludes: 'The Black Baron obviously fancies himself as one of the UK's top programmers.'

The S&S detection software will be available as part of its Toolkit anti-virus software from next month.

S&S International has a freephone telephone line for those seeking more information on Smeg. Pathogen and Smeg. Queeg, 0800 136657.

Comments