The Register® — Biting the hand that feeds IT

VXers make a monkey out of gullible surfers

Gorillas in the malware

Free whitepaper – Securing your online data transfer with SSL

Social engineering tricks by virus writers took a strange twist this week after hackers bundled malicious code with pictures of a famous dead albino gorilla. The Wurmark-K email worm displays a picture of Snowflake (AKA Copito de Nieve), an inmate of Barcelona Zoo until his death in November 2003, as it goes about its job of infecting Windows machines.

The Wurmark-K worm spreads as an email attachment in emails with subject lines such as "Your Photo Is On A Webpage!!". If recipients open the attached ZIP file and launch the files inside (with names such as Sexy_02.scr or Lover_01.scr) on Windows machines they become infected by the worm and a graphic of an albino gorilla is displayed. As the image is rendered, Wurmark-K installs the Rbot-ABK network worm and backdoor Trojan horse, enabling hackers to subsequently steal information from an unsuspecting user or plant other malicious code.

Graham Cluley, senior technology consultant for Sophos, said the gorilla picture is displayed only after a machine becomes infected. The tactic would lead people to believe the email was just a joke, he added.

Although the Wumark worm presents a very serious security threat it's found few takers so far. Most anti-virus vendors rate it as a low risk. In any case it makes sense for surfers to protect their PCs behind personal firewalls and up-to-date anti-virus software. ®

Related stories

Banking Trojan disables MS Anti-Spyware
VXer targets Romanian gypsy music
It's time to pick your favourite virus
Car virus myth debunked

Free whitepaper – Certify your software integrity with Thawte code signing certificates

Don’t Miss

HandcuffsFeds: Hospital hacker's 'massive' DDoS averted

Arrest foils 'Devil's Day' scheme

thumbs down teaser 75Buggy 'smart meters' open door to power-grid botnet

Grid-burrowing worm only the beginning

MicrosoftMicrosoft knew of nasty IE bug a year before attacks

Security delayed or security denied?

BlockMaster SafeStickBlockMaster SafeStick hardware-encrypted USB drive

Review Tough enough?