Hackers use porn worm to take over PCs

Help and Discussion

Moderator: The Mod Squad

Hackers use porn worm to take over PCs

Postby Copper » Wed Jan 19, 2005 9:19 am

Hackers use porn worm to take over PCs
Mass-mailer claims to clean adult content from computers
Iain Thomson, vnunet.com 18 Jan 2005

Antivirus experts today warned that a mass-mailing worm designed to fool computer users into believing that pornographic content has been found on their PC actually allows hackers to gain remote access to compromised computers.

The Baba-C worm (W32/Baba-C) spreads via email, duping innocent users into believing that it is a warning about 'XXX content' found on their Windows PCs. Users are told that this adult material can be hidden by running a program called Evidence Cleaner.

However, in reality, no pornographic content has been found on the PC, and clicking on the attached file runs the worm which will attempt to forward itself to other email addresses, and open a backdoor for hackers to gain access to the system.

Emails sent by the worm arrive with the subject line: 'Important! XXX sites found on your computer!'

They contain the following message: 'Windows Evidence Checker has found XXX content on your computer. You can hide your activities with Evidence Cleaner service. To run Evidence Cleaner click to quick shortcut attached. Warning! Your copy of Evidence Cleaner will be expired after 7 days. Today you can register for FREE. Please check attached instructions for more details.'

The attached file tries to disguise itself as a web link, but is in reality a malicious executable file.

"Many people are worried about the adult material that inhabits areas of the internet, and don't want it to reach their PC. It's also clear that the internet is widely used for accessing hardcore sexual material," said Graham Cluley, senior technology consultant at Sophos.

"Either way, many people want to ensure that their PC contains no evidence of XXX content, and may be tempted to follow this email's instructions if they are sent this worm.

"The Baba-C worm is using a dirty trick. Our advice, as always, is to keep your antivirus software up-to-date and never launch an unsolicited email attachment."

Sophos noted that there have only been a small number of reports of Baba-C infecting PCs in the wild. Further details of the worm can be found here.

"Only two thing are infinite, the universe and human stupidity,and Im not sure about the former." Albert Einstein (1879 - 1955)
Black Belt 5th Degree
Black Belt 5th Degree
Posts: 8640
Joined: Mon Jul 14, 2003 12:38 pm
Location: Midlands UK

Postby _Menschenwurst » Wed Jan 19, 2005 11:00 am

If it's a popup window, that I've seen before, or a link sent in an email. God help people who are dumb enough to click on it.
Posts: 39
Joined: Sat Jan 08, 2005 12:07 am
Location: Buffalo

Postby Ghen » Wed Jan 19, 2005 11:34 am

I fix computers all the time that have virii like these. Its not really all that damaging to people without critical files on the computer.
Black Belt 5th Degree
Black Belt 5th Degree
Posts: 5806
Joined: Wed May 26, 2004 3:06 pm
Location: Delaware

Postby snap355 » Wed Jan 19, 2005 1:58 pm

damn, I keep getting these dialers :lol:
[url=http://www.motherboards.org/folding/index.html] Lend a hand and help with the folding project. Come join our 33258 team!

Black Belt 5th Degree
Black Belt 5th Degree
Posts: 9258
Joined: Mon Sep 13, 2004 3:22 pm
Location: 33258

Return to Virus/Spyware/Security

Who is online

Users browsing this forum: No registered users and 1 guest