After Stormy Start, Worm Turns to Love in Major New Attack

Experts at SophosLabs have warned of a major new malicious attack occurring against internet users since 2:00 GMT. New variants of the Dorf malware family -- earlier incarnations of which purported to be breaking news of deaths caused by European storms -- are now using disguises associated with love and greeting cards.

Subject lines used in the spam campaign are many and varied. Some of them include "You're so Far Away", "I Dream of you", "Old Together", "Dream Date Coupon", "Together You and I", "A Bouquet of Love", "So in Love", "Cuddle Up", and "Vacation Love".

Attached to the e-mails are files called flash postcard.exe or greetingcard.exe, which contain the worm.

Opening the attached files activates the worm, which then sends itself to other e-mail addresses found on the now infected computer. Analysts believe that the worm code is designed to attempt to download further malicious code from the Internet designed to take over the computer, convert it into part of a zombie network, and use it to send spam on behalf of hacking gangs.

"People must learn to think before they click," said Graham Cluley, senior technology consultant. "It may be tempting to open an attachment which you think is a greeting card or a message from a loved one, but love can get you into trouble sometimes. The best defense is common sense, combined with up-to-date anti-virus software and e-mail filtering at your gateway."

KW