[ISN] Paris Hilton worm spreads

[InfoSec News]

http://news.zdnet.com/2100-1009_22-5587278.html

By Dan Ilett
ZDNet (UK) 
February 23, 2005

An e-mail worm promising explicit pictures of hotel heiress Paris
Hilton is spreading widely, antivirus experts warned on Wednesday.

The mass-mailing worm, Sober.K, is currently the third most commonly
encountered virus, making up 10 percent of all viruses detected in the
last 24 hours, Sophos reported.

"This latest variant of the Sober worm may catch out the unwary as
they open their e-mail in-box," said Graham Cluley, senior technology
consultant at Sophos.

"Although much-publicized virus outbreaks in the past should have made
users more nervous of double-clicking on unsolicited e-mail
attachments, some still find it hard to resist," he added. "All users
should be reminded to follow safe computing guidelines, and PCs should
be kept automatically updated with the latest antivirus protection."

The new Sober variant sends itself in German and English, using a
variety of subject lines, including "Paris Hilton, pure!" and "Paris
Hilton SexVideos."

The Zafi.D virus, which was released last year, is Sophos' most
prevalent, accounting for 27.6 percent of all reports in the last 24
hours. The Harry Potter Netsky.P worm is in second position with 22.4
percent.

Hilton shot to prominence after starring in a home video that became
an Internet phenomenon. On the same day that Sober.K was discovered,
it was reported that hackers had broken into Hilton's cell phone and
stolen the telephone numbers of celebrities before posting them
online.

A second, more dangerous worm that uses similar bait, Ahker.C, was
also discovered this week. The Ahker-C worm disables antivirus and
firewall settings, and blocks access to some Web sites. It sends
itself with the subject line "Paris Hilton...download it!" and a file
called "ParisXXX.zip", which contains the virus.