NEWS FROM THE LAB - Tuesday, January 18, 2005

Porn site fighting back at Mydoom Posted by Mikko @ 18:38 GMT

Latest variant of Mydoom was going around during the weekend.

One of the messages posted by this virus loaded images from a porn site, and made the message look like the infected attachment actually contained info on how to access such a site:


So, we contacted the administrators of this site and explained what was going on. We adviced them to stop using these specific images shown by the virus and replace them with an image with a warning of some kind.

Well, the good admins at worldxxxpass.com have now done just that. The messages sent by Mydoom now look like this:


PS. For something slightly different; today's Washington Post contains an interesting article on phishing by Brian Krebs.

PS2. Kaspersky Lab's weblog just reported the first sighting of Cabir worm in UK.