KaZaA Virus Discovered

According to an advisory posted late on Friday, the Worm.Kazaa.Benjamin virus transmits itself using the KaZaA network. According to the virus definition, however, the virus only appears to spread by manual transmission, or voluntary downloading of affected files.

In fact, the worms effects appear to onlly be to open a web page hosted on a German site. Kaspersky hasnt associated any worms or trojans with the web page itself.

When the worm is installed, it generates an error report bulletin with an acknowledgement button. The worm then copies itself to the %WinDir%\SYSTEM directory as EXPLORER.SCR, and upon the launch of the KaZaA file-sharing program renames several copies of itself under various names while making the directory open to the public. The net result is that unsuspecting users download copies of the virus, spreading it.

Kaspersky did not state whether the files hiding copies of the virus posed as songs, movies or other software.

The virus definition has been added to Kasperskys list of definitions. Nortons Symantec virus encyclopedia currently doesnt list the worm, a Norton spokesman confirmed.

The Worm.Kazaa.Benjamin virus is not the first to strike the network; in November 2001, Norton and others detected the W32.Elem.Trojan worm or "Element" virus, which overwrites system files. Although the virus could be spread through email like other worms, the virus typically was passed on through KaZaA and other file-sharing programs.