I do not think there is any such thing as a good virus

Graham Cluley

In early May a computer worm called "Cheese" was discovered that targeted computers running the Linux operating system and closed a well-known security hole that could have been exploited by malicious hackers.

Following Cheese was the Mawanella virus created by activists to draw attention to the ongoing conflict in Sri Lanka. There has also been a virus protesting about the actions of former Philippine president Joseph Estrada. The latter two viruses both exploited the security failings of Microsoft's popular Outlook software.

Now one virus creator has produced a program dubbed "Noped" that is a crude attempt to catch paedophiles and those who traffic child pornography. The virus arrives as an attachment to an email entitled "FWD: Help us all to end illegal child porn now."

Like the Love Bug and Melissa viruses the Noped program plunders the address book from Microsoft Outlook and attempts to e-mail a copy of itself to every name it finds there.

Image scan

On any infected machine, the virus scans the hard disk looking for any image files stored using the JPEG format. The virus checks the names of any image files it finds against a list of possibly suspicious names generated by whoever wrote the virus.

If it finds any files that it thinks could contain child pornography, the virus randomly picks an agency known to be tackling the problem from another list, then it sends a message to that address.

The automatically generated message reads: "Hi, this is Antipedo2001. I have found a PC with known Child Pornography files on the hard drive. I have included a file listing below and included a sample for your convenience".

"The author of this would argue it's doing some good," said Graham Cluley of anti-virus company Sophos. "But I do not think there is any such thing as a good virus."

We would waste more of our time trying to look at anything reported in this way rather than the reports we get enough of at the moment

David Kerr, Internet Watch Foundation

He said the scanning of files was so crude that it was unlikely to catch any paedophiles, or unearth a hidden cache of child pornography. The virus is not very widespread and does not seem to be infecting many machines, said Mr Cluley.

David Kerr, chief executive of the Internet Watch Foundation, said the organisation would be unlikely to react to any e-mail it received from the virus.

"We would waste more of our time trying to look at anything reported in this way rather than the reports we get enough of at the moment," said Mr Kerr. "It could simply clog up our systems."