That Was the Week That Was!

Kaspersky Lab�s prediction came true!

Back in 1998, the last week of October brought a real surprise in the computer world. Kaspersky Lab Int. anti-virus research team detected "WinScript.Rabbit" - a computer virus using new methods of contamination and infecting Windows scripts (programs written in Windows command language). When started the virus looked for other files (scripts) on the disk and substituted them with a copy of itself. The most dangerous feature of the virus was that it was capable of transmitting itself via the Internet and the most advanced browsers executed infected scripts on a local computer, even when they were located on the remote Web server.

The concept of this type of virus was earlier implemented in several viruses for UNIX. In the late 80ties, viruses that were written in the command language of UNIX clones became a real curse for global computer networks. The most famous members of this family were network worms called Christmas Tree, HI.COM and Wank Worm. At the time Kaspersky Lab predicted that the new Windows script-virus may well become the patriarch of the new family of network worms.

The detected virus was the first known to infect Windows scripts. Its structure was very simple and contained about 10 commands. There was a set of inaccuracies that immediately unmasked the virus once it appeared within a system: when started from the remote Web server the virus infected all the files in the browser cache and copied them onto the computer Desktop - the browser working directory. At that point the computer Desktop fills with icons of infected script - the virus proliferated like a rabbit, hence the name WinScript.Rabbit.

At the time, within a press release subtitled "New computer virus is written in Windows command language! Will it be the real nightmare for users of the Internet?"� Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Lab said, "Despite of all these inaccuracies and the simplicity of the code, this virus is a potential threat for users of the Internet. Its mechanism of self-distribution is based on the powerful features of contemporary global networks. This virus might well be taken as a model for the new viruses that will adopt the same method of self-distribution."

He continued, "We expect many more new viruses of this type infecting not only scripts but also other elements of Windows OS and also Web servers. This virus is capable of working under all versions of Windows32 (Windows95/98/NT) where Microsoft Scripting Host can be found. Script-support is a standard feature of Windows98 and NT 5.0. Other versions of Windows and Windows NT may obtain this feature through updates." Sounds familiar?

Eighteen months later, a then little known Filipino student sent his message of love into the ether and it seemed as if Eugene Kaspersky's predictions were coming true as the infamous "LoveLetter" worm infected and crippled systems all over the world causing huge financial losses.