With just weeks remaining until the release of the last ever Harry Potter novel, and the imminent premiere of the fifth movie in the franchise, Sophos has warned of a new computer worm exploiting Potter-mania around the world.
The W32/Hairy-A worm can automatically infect a PC when users plug-in USB drives, which carry a file posing as a copy of the eagerly anticipated novel, “Harry Potter and the Deathly Hallows”. If the users have allowed USB drives to ‘auto-run’ they will see a file called
HarryPotter-TheDeathlyHallows.doc
Inside this Word document file is the simple phrase “Harry Potter is dead.” The worm then looks for other removable drives to infect.
After infecting Windows computers, the worm creates a number of new users - namely the main characters from JK RowlingÂ’s celebrated series of books about student wizards: Harry Potter, Hermione Granger and Ron Weasley.
The worm creates users on the infected PC in the name of characters from the JK Rowling books
After logging in, users are shown the following message via a batch file:
read and repent
]
the end is near
repent from your evil ways O Ye folks
lest you burn in hellÂ…JK Rowling especially
In addition, everytime infected users open Internet Explorer they will find their start page has been redirected to an Amazon.com web page selling a spoof book entitled “Harry Putter and the Chamber of Cheesecakes”.
“Much of the world is waiting with bated breath for the final Harry Potter novel, and the premiere of the new movie is looming too. There is a real danger that muggles will blindly allow their USB flash drives to auto-run and become infected by this worm,” said Graham Cluley, senior technology consultant for Sophos. “Using such social engineering at this time is a trick dastardly enough for Lord Voldemort himself.”
More about the worm
The worm redirects Internet Explorer to an Amazon.com webpage offering a parody of the Harry Potter books.
“The fact that this worm has been inspired by the tales of a fictional schoolboy wizard doesn’t make it a harmless prank,” continued Cluley. “A worm like this which infects and tampers with users’ computers without their permission is committing a criminal act. Someone needs to get a little more sunshine in their diet and put their energies into a more positive pursuit than writing malicious code like this.”
Unlike most malware written today, the Hairy worm does not appear to have been written with financial reward in mind.
“This is an ‘old school’ virus, written to give the author a platform to show off rather than to steal identities or cash,” said Cluley. “This person isn’t being driven by the desire to inflate his or her bank account, but by a loathing for JK Rowling and her incredibly popular books.”
Sophos notes that this is not the first time that the residents of Hogwarts School have been exploited by cybercriminals. In 2005 spammers tried to make money fast by claiming that recipients could win an advance copy of the then latest book in the series, “Harry Potter and the Half-Blood Prince”. The year before, a virus pretended to be a downloadable version of the movie “Harry Potter and the Prisoner of Azkaban” on peer-to-peer file-sharing networks.
Sophos has been automatically protecting customers against the W32/Hairy-A worm since 19:42 GMT on 27 June 2007.
Recently experts at SophosLabs™, Sophos’s global network of malware and spam analysis centers, have reported an increasing trend for malware authors to spread via USB devices.
Sophos experts advise that users disable the autorun facility of Windows so removable devices such as USB keys and CD ROMs do not automatically launch when they are attached to a PC. Any storage device which is attached to a computer should be checked for virus and other malware before use. Floppy disks, CD ROMs, USB keys, external hard drives and other devices are all capable of carrying malicious code which could infect the computers of innocent users.
Sophos recommends companies protect themselves with a consolidated solution which can defend against the threats of viruses, spyware, spam and hackers.
Source: SOPHOS
