The "Thursday" virus emerged more than a week ago, but its spread rate jumped dramatically in the last 24 hours, said Allison Taylor, a marketing manager at Network Associates. Of the 5,000 or so computers so far infected, more than half were at financial institutions, Taylor said.
If left untreated, the virus will delete all files on a Windows computer's C: drive on December 13, she said. The name "Thursday" came from the letters "Thus," which appear in the virus code. The virus, written in the "macro" programming language that can automate Microsoft Word tasks, spreads from one document to another, but doesn't actively send itself to new computers. It infects computers running Office 97 and Office 2000.
It's unclear why exactly banks were affected, Taylor said, except that one possible reason is "they swap a lot of data and they work continually." The surge could have resulted from end-of-month reports being shared widely, she said.
Network Associates' competitors, however, pounced on the announcement, saying that their software found the virus automatically and that the virus wasn't that big a of deal.
"This is nothing very exciting," said Symantec Antivirus chief researcher Carey Nachenberg. Only one Symantec customer has reported infection, he said.
And TrendMicro's Dan Schrader said his software's "heuristic" detection mechanism found "Thursday" without trouble, even though the particular virus hadn't been seen before. "Thursday" is dangerous, but routine, he said. His company probably finds about 20 similar viruses a month.
Play video
There are currently no comments for this post.