Oh no. I have a horrible sinking feeling this morning.

There appears to be a new email virus getting started; I've received two copies of it this morning and have never had any like it before today.

We have previously seen many, many viruses which attach Windows executables to mails; these are easy to spot and reject at SMTP time, and the machine on which I receive my mail has been cheerfully doing so for about a year and a half, leaving me only the cruft of misaimed virus warning mails responding to things forged on my behalf. ixion's virus webpage recommended that if you really needed to send a Windows binary you could zip it to get it through the filters.

Some time last year, some virus author escalated the issue and started zipping their viruses. Arrgh. Seeing no alternative, I upgraded my virus scanner to look inside zip files too, and the wording of the advice on ixion's web page had to be changed. An uneasy peace prevailed for a while.

Today, I have received two viruses each quoting a five-digit password in the mail body. The attached zip file is encrypted with that password.

This horrifies me for two reasons.

Firstly, I had previously assumed that the vast success of email viruses was primarily due to Windows mailers either automatically opening and running executable attachments, or at the very least making it easy to do so with a single misaimed click. And I had assumed that the reason zipped viruses still worked was that Windows was trying its hardest to treat archive files as subdirectories, so that it didn't make much difference to the recipient. But this kind of virus is AI-complete; there's no reasonable way in which a mailer could automatically pick out the password, decrypt the zip file and offer the user its contents to click on. This virus genuinely works on (as one running joke had it) the honour system: you have to deliberately type in the password before you can get infected. And the idea that there are enough people out there who will go to those lengths to fall for a scam just depresses me.

Secondly, this is going to be a serious problem to my virus scanning strategy. Hitherto I've been employing measures that don't in general need to be updated when new viruses come along; as long as the new viruses work on basically the same model as the old ones (mailing a possibly-zipped executable as a MIME attachment), they have been automatically rejected without me ever needing to know or care that the details had changed. But in order to correctly identify this kind of virus, my scanner will need to pick the password out of the message body and then apply it to the zip file; and since it isn't an AI and can't understand English, the only way I can think of for it to do that is by having a specific knowledge of the precise format of the messages sent by this particular virus, which sets the dangerous precedent that perhaps I might have to turn into one of those people who devotes a perceptible fraction of their time to virus-fighting, responding individually to every new strain. Which I suppose I wouldn't mind too much, if email were my job or anything approaching my primary function; but really it isn't, and it annoys me that it's threatening to have to be.

Also it somehow feels deeply unfair, since I'm not even the target of these viruses; I read my mail on a Linux box, for goodness' sake, which wouldn't be able to run the wretched binaries even if my mailer did automatically extract them from their multiple layers of wrapping. Their only inconvenience to me is as a particularly high-volume form of spam, and one which has historically made up for this extreme volume by being extremely identifiable and easy to block. It somehow makes me feel particularly irked that all of this inconvenience is by way of fallout from a war between virus writers and Windows users, and I'm pretty much an innocent bystander caught in the crossfire…

Oh well. I've just gone for an hour-long meeting in the middle of writing this and I haven't seen any more of them in the meantime, so perhaps this one won't spread. I hope.