Worm tricks users with fake porn warning

Baba-C tries to trick users into thinking there's pornographic content on their PCs, and then offers to hide the evidence.

If you get an e-mail about a pornographic ghost in your machine, don't click the attachment. It's really a fake warning designed to infect computers with the latest Baba worm.

Lynnfield, Mass.-based antivirus firm Sophos offered that warning in an advisory this week. The firm said W32.Baba-C tries to fool users into believing their PC is infested with adult content. It then offers to run a program that will hide it. In reality, there is no X-rated content on the computer, and clicking on the attachment will unleash the worm.

Baba-C will then attempt to forward itself to other e-mail addresses and open a backdoor that attackers could use to access the system.

"This arrives in an e-mail disguised as a warning that 'Windows Evidence Checker' has found pornographic content on your computer," said Graham Cluley, senior technology consultant for Sophos. "Users are then told the adult material can be hidden by running a program called 'Evidence Cleaner.' So far this doesn't look like anything widespread, but it's another example of why people should be very leery of unfamiliar attachments."

For enterprises, Cluley said, "the danger is that people will see the message, panic and click the attachment to clean up their computers so they don't get in trouble at work. People might click before they think."

His advice: "Don't panic when you see a message that pornographic material has been found on your computer. And, as I said, be very wary of unfamiliar attachments."

What it looks like
If you get an e-mail with Baba-C attached, you'll see the following characteristics:

  • Subject: Important! XXX sites found on your computer!
  • Message body: Windows Evidence Checker has found XXX content on your computer. You can hide your activities with Evidence Cleaner service. To run Evidence Cleaner click to quick shortcut attached. Warning! Your copy of Evidence Cleaner will be expired after 7 days. Today you can register for FREE. Please check attached instructions for more details.
This Content Component encountered an error

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close