Original URL: http://www.theregister.co.uk/2002/05/16/outlook_worm_markets_porn_site/

Outlook worm markets porn site via your sig

How blush-making...

By John Leyden

Posted in Security, 16th May 2002 13:57 GMT

A malicious Javascript worm adds a link to a porn site on emails coming from infected users' machines, AV firms have warned.

JS.Fortnight drops a file on a victim's Windows PC which is then inserted into the default signature for Outlook Express. Every time the infected computer sends an email message, the message will contain the malicious code.

JS.Fortnight also changes the home page of browsers on infected computers to rawtocash.net, and adds this site (which appears to have been pulled) to a user's favourites menu. Suspicion for the creation of the worm has fallen on scam artists who are probably using it as a ploy to attract traffic to particular sex sites.

The worm is neither widespread nor damaging, at least to a victim's PC. However given the potentially embarrassing consequences of becoming infected, it's certainly something to be wary of.

Users are advised to update their AV protection and practice safe computing, which (among other things) involves being wary about opening unsolicited email attachments. ®

Related Stories

Hoax virus alert could cripple Windows Java
The IE back-button attack
Hotmail vulnerable to JavaScript exploit
Major privacy hole in Windows/MSN Messenger
Gigger worm can format Windows PCs
Serious Outlook hole patched