Introduction

There has been some speculation in the media about lots of new viruses with payload 1 January 2000. Apparently this has by some been connected to the general so-called Y2K problem, which has to do with program failing on that date.

This weeks security information will discuss the danger involved and look at what we know about this at this point in time.

About virus attacks in general

The severity of a virus attack is dependant on several parameters. Among those are:

1. The payload in a virus
2. The maliciousness of such a payload
3. The virus' ability to propagate
4. The actual spread of a virus

There are approximately 40,000 known computer viruses. Among those only a minor percentage are "In the Wild", thus in compliance with item 4 above.

Item 2 and 3 are in many instances in conflict with each other. If the virus has a particularly malicious payload, e.g. deleting all files on a computer when infected, its ability to propagate gets smaller.

We have seen several instances in 1999 that some of the viruses which have had the most successful propagation have a payload on a particular date (CIH) or are not especially malicious. Another characteristic with the most "successful" virus attacks are that they have used new techniques (e.g. Melissa which used e-mail to propagate).

The viruses' payload dates are distributed on different dates around the year. Should we be particularly worried about virus attacks at the turn of the millennium?

What we know about the virus threat 1 January 2000

When this security information is written we do not know of any viruses In the Wild which have their payload 1 January 2000. One may speculate about virus authors aiming at year 2000, but at this point in time nothing in particular seems to indicate this.

To focus on this date as a particular threat is in our view to obscure the problem. Virus protection should be seen as a continuous task. One should download the most recent virus detection files from a serious virus control company all year through.

Norman will of course monitor the situation carefully and will update our virus detection files constantly at the end of the year if this is seen as needed.

Per Olav Førland