-We've had no reports in the wild, we're still waiting for the vendor to get it into the research groups," David Banes, region manager of Symantec security response told ZDNet Australia. -It's debatable whether this has been seen by real world people or is just a proof of concept thing sent in by the authors." According to Banes, viruses are normally put into the research groups as soon as possible, but there could be a glitch due to the weekend.
Kaspersky Labs, an international data-security software developer, reported the new worm, Worm.Kazaa.Benjamin, which spreads through the Kazaa file exchange network
When the worm is downloaded onto a computer it displays a false error message, and then installs itself in the system directory. The worm executes after the computer restarts.
Benjamin creates a new directory and makes it accessible to all Kazaa users and then copies itself into this directory under a multitude of names, reportedly in the range of several thousand. When someone on the Kazaa network searches for a file with a name corresponding to one of the worm's pseudonyms, they get the chance to download the worm onto their computer.
The worm then uses the name of the infected computer owner to open an anonymous Web site from which it displays advertising banners.
-The architecture of the program has allowed someone to write a worm to take advantage of it," Banes said. -I don't think security was very high on the list when peer-to-peer was being created."
Banes added that because of the nature of peer-to-peer networks, service-based antivirus programs would have minimal effect and it is up to the individual user to run an updated virus program.
