Virus writers have created a proof-of-concept file infector specifically for machines that run Advanced Micro Devices Inc.’s AMD64 64-bit processors, antivirus companies said yesterday. It is not in the wild, nor considered dangerous.
Symantec Corp. named it Shruggle, as its code is apparently based on Shrug, a family of 32-bit viruses. It also looks a bit like Rugrat, a proof-of-concept virus designed to work on Intel IA64-based Windows machines, sent to anti-virus firms in May.
Shrug and Rugrat are both thought to have been authored by Roy G Biv, a longtime malware author who typically writes proof-of-concept code with no malicious payload and submits it to antivirus firms, rather than release it into the wild
Alfred Huger, senior engineer at Symantec Security Response, could not confirm the same author is responsible, but said it looks like Shruggle has no malicious intent. Symantec found it on a sample-sharing network used by antivirus firms.
While Intel and AMD’s 64-bit instruction sets are a little different, neither is more susceptible to viruses, Huger said. Rugrat and Shruggle are written in assembly language, whereas most viruses tend to be written in higher-level code.
This shows that viruses are being developed for 64-bit processors, Huger said. The worldwide move to 64-bit will not preclude the need for virus detection, he indicated.