Canadian popstar Avril Lavigne is just the latest in a growing list of celebrities that virus writers have chosen to use to mask their handiwork.
The latest worm, known as Lirva, reaches the user’s inbox with subject lines such as “Fw: Avril Lavigne- the best ever,” among a variety of others used to disguise the virus.
The e-mail contains attachments with names such as “AvrilSmiles.exe.” Once the attachment is run, the worm attempts to disable the user’s antivirus software and also behaves much like an ’80s film stereotype of a virus by taking over the screen with a series of coloured ellipses, according to information posted on antivirus software maker Sophos Inc.’s Web site.
The W32 worm is able to take advantage of a vulnerability in Microsoft Outlook, that allows it to forward itself to all e-mail addresses, whether the e-mail attachment is opened or not. Once executed, the worm opens the user’s Internet Explorer browser on the official Avril Lavigne Web site on the 7th, 11th and 24th of each month, Sophos said.
Microsoft said it has already patched the Outlook hole. For details, visit http://www.microsoft.com/technet/security/bulletin/MS01-027.asp to download the security patch.