News: Outlook markets porn site via your signature.

A malicious Javascript worm adds a link to a porn site on emails coming from infected users' machines, AV firms have warned.

JS.Fortnight drops a file on a victim's Windows PC which is then inserted into the default signature for Outlook Express. Every time the infected computer sends an email message, the message will contain the malicious code.

JS.Fortnight also changes the home page of browsers on infected computers to rawtocash.net, and adds this site (which appears to have been pulled) to a user's favourites menu. Suspicion for the creation of the worm has fallen on scam artists who are probably using it as a ploy to attract traffic to particular sex sites.

The worm is neither widespread nor damaging, at least to a victim's PC. However given the potentially embarrassing consequences of becoming infected, it's certainly something to be wary of.

Users are advised to update their AV protection and practice safe computing, which (among other things) involves being wary about opening unsolicited email attachments.


Source: http://www.blackcode.com/news/view.php?id=244

ROFL...

When is MS going to learn... auto-execution of code on the user's behalf is a BAD thing.


Wondering how long before someone just writes a worm that silently spreads via email... then, on a given day, reformats everyone's hard drive for them. Or something equally destructive.

Thanks go to Bill for enabling us to execute pretty much any program on a Windows machine from pretty much any MicroSoft application, all in the name of "convenience and simplicity." Funny, in the old days of things like pipe eploits to sendmail... it was fixed prety darn fast... now, well, they just keep improving the bugs (AKA "features") to enable even further, more destructive potential behaviours.

The Symantec write-up of JS.Fortnight is:

The Link

:)