That Was the Week That Was!
12 Jun 2000
Kaspersky Lab�s prediction came true!
Back in 1998, the last week of October brought a real surprise in the computer world. Kaspersky Lab Int. anti-virus research team detected "WinScript.Rabbit"
- a computer virus using new methods of contamination and infecting Windows
scripts (programs written in Windows command language). When started the virus
looked for other files (scripts) on the disk and substituted them with a copy
of itself. The most dangerous feature of the virus was that it was capable of
transmitting itself via the Internet and the most advanced browsers executed
infected scripts on a local computer, even when they were located on the remote
The concept of this type of virus was earlier implemented in several viruses
for UNIX. In the late 80ties, viruses that were written in the command language
of UNIX clones became a real curse for global computer networks. The most famous
members of this family were network worms called Christmas Tree, HI.COM and
Wank Worm. At the time Kaspersky Lab predicted that the new Windows script-virus
may well become the patriarch of the new family of network worms.
The detected virus was the first known to infect Windows scripts. Its structure
was very simple and contained about 10 commands. There was a set of inaccuracies
that immediately unmasked the virus once it appeared within a system: when started
from the remote Web server the virus infected all the files in the browser cache
and copied them onto the computer Desktop - the browser working directory. At
that point the computer Desktop fills with icons of infected script - the virus
proliferated like a rabbit, hence the name WinScript.Rabbit.
At the time, within a press release subtitled "New computer virus is written in Windows command language! Will it be the real nightmare for users of the Internet?"� Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Lab said, "Despite of all these inaccuracies and the simplicity of the code,
this virus is a potential threat for users of the Internet. Its mechanism of
self-distribution is based on the powerful features of contemporary global networks.
This virus might well be taken as a model for the new viruses that will adopt
the same method of self-distribution."
He continued, "We expect many more new viruses of this type infecting not
only scripts but also other elements of Windows OS and also Web servers. This
virus is capable of working under all versions of Windows32 (Windows95/98/NT)
where Microsoft Scripting Host can be found. Script-support is a standard feature
of Windows98 and NT 5.0. Other versions of Windows and Windows NT may obtain
this feature through updates." Sounds familiar?
Eighteen months later, a then little known Filipino student sent his message
of love into the ether and it seemed as if Eugene Kaspersky's predictions were
coming true as the infamous "LoveLetter" worm infected and crippled systems
all over the world causing huge financial losses.