Sophos warns of black dog virus

By Alun Williams

Posted on 31 Jul 2003 at 12:02

Cidu-A and Randon-R are trying to spread to a network near you.

Unlike the most recent batch of viruses these two new threats do not use email for spreading themselves. Instead, they rely on network shares, with peer-2-peer swapping environments such as KaZaA helping to do the work.

As of yet, these viruses are not widespread. There have only been a few reports of activity 'in the wild'.

Apparently written in Delphi, the Cidu-A virus searches your hard drive looking for executables and overwriting them with copies of itself. And it marks them as hidden, system and read-only files.

Characteristically, it displays a picture of a black dog merged with a human face. Sophos also warns that it can replace your Desktop icons, disables your taskbar and disable your keyboard or mouse.

Randon-R is a network worm. Like the long-lasting Bugbear, it searches out attached network devices - looking for computers with weak or non-existent passwords on the administrator accounts.

You can find more info on Cidu-A and Randon-R, including virus identity files, at the Sophos website.