There's been all sorts of rumor and story-making flying around the Intarweb the past few days about a supposed first virus to attack some new part of Windows Vista (which is the next generation of the Windows Operating System - Vista was released recently in a Beta 1 test version to a closed group of testers and MSDN subscribers).

Well, it turns out that's not quite true.

Now, there might be a proof-of-concept script-based "virus" that takes advantage of a new beta shell technology called Monad. But Monad is not part of the Windows Vista beta, it won't be part of the release when Vista is done, and as such the rumors are inaccurate and based in false assumptions, according to the Microsoft Security Response Center weblog (which, by the way, security and IT professionals should subscribe to).

"There’s been some commentary the past couple of days regarding a potential Windows Vista virus and we wanted to weigh in with some details.  First of all, in examining the details of the reports, there is no Windows Vista virus described in them. Instead, the reports are regarding potential proof of concept viruses in the form of malicious scripts that are developed to affect a new interactive shell codenamed Monad, which is currently in early phase of beta testing.

"Now to be clear, these reports pose no risk for Microsoft customers. The viruses do not attempt to exploit a software vulnerability and do not encompass a new method of attack.  Furthermore, Monad is not widely available for general use. It’s a beta, and we do not recommend or support the use of beta software in a production environment. Microsoft continues to analyze the feedback from testers as Monad continues to be developed.

"But most important, Monad is not included in the beta release of Windows Vista or in Windows Server 2003 R2.

"Monad will not be included in the final version of Windows Vista and there is no relation between Monad and Windows Vista Beta 1. Monad is being considered for the Windows Operating System platform for the next three to five years.  So these potential viruses do not affect Windows Vista or any other version of Windows if Monad has not been installed on the system."

Note that Microsoft did not decide to pull Monad from Windows vista in response to this Monad virus scare/story, and they point out that Monad is an early beta technology, not intended to be used in a production environment. Well, yeah... Duh...

It's worth repeating that last point: Beta versions of commercial software are - by their very nature - not fully tested or officially QA'ed, and as such one has to consider beta code to be less secure in general. That should always be considered in deployment.

This is a great example of rumor run rampant, assumption trumping investigation, and the power of hate amongst those who drink of that darker cool-aid, and who wish for nothing less than harm to befall a great-big software company. If you want to believe something bad enough, if you're waiting in the trenches for something to jump on, if you do that often enough and get crazed enough in the process, you're going to lose your perspective. In my previous career, where I sometimes had to deal with those sorts, they call that a cult mentality.

Anyhow - Point is, it wasn't true. And that's something that should be said.