01/18/2005

A spam e-mail asking for donations to help victims of the Indian Ocean tsunami disaster contains a new virus, security experts warned yesterday, saying the attack represents a “new low” by hackers.

According to security firm Sophos, the message contains the heading “Tsunami Donation! Please help!” It encourages readers to open an attachment for further information. Doing so triggers an attempt to load the new W32/VBSun-A worm onto computers.

The worm then e-mails itself to addresses found on the infected computer. It could also be used to launch a denial-of-service attack (where a web server is flooded requests for information, overwhelming the system and ultimately crashing it) against a particular German hacking web site.

"This gruesome insensitivity is a despicable ploy to get curious computer users to run malicious code on their computers,” said Graham Cluley, senior technology consultant at Sophos. “Everyone should be wary of unsolicited e-mail attachments.”

In the weeks since the disaster there have been numerous warnings against on-line scams that exploit the public's interest in helping victims, ranging from attempts to siphon donations to imbedding Trojans in the computers of visiting net users.

Enforcement agencies have warned that they will vigorously pursue those behind the scams, and only last week the FBI made its first arrest, collaring alleged spammer Matthew Schmieder.

According to reports, Schmieder was supposedly responsible for sending about 800,000 fake fundraising messages, but was tracked down by Spamhaus, the UK-based anti-spam group.

Note: W32/VBSun-A is a simple mass mailing worm written in Visual Basic. It attaches itself to emails with the following characteristic:

Subject line: Tsunami Donation! Please help! Message text: Please help us with your donation and view the attachment below! We need you! Attachment name: tsunami.exe

W32/VBSun-A will attempt to send itself to addresses found in the victim's outlook address book.

W32/VBSun-A will drop the following files in the Windows folder: crssr.exe raz32.exe tsunami.exe

The following registry entry will be created so that the worm is run when a user logs on to Windows: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CaptionMgr32

W32/VBSun-A will also attempt to carry out a DoS against www.hacksector.de.