Abingdon, England -- A British software security firm is cautioning Harry Potter fans not to open an e-mail that promises the series finale but delivers a PC-infecting worm.
Security company Sophos warns on its Web site that an e-mail hawking a copy of "Harry Potter and the Deathly Hallows," not due in stores until July 21, really hosts the W32/Hairy-A worm that attempts to infect the impatient Potter fan's USB memory drives.
Instead of J.K. Rowling's final installment, HarryPotter-TheDeathlyHallows.doc states, "Harry Potter is dead." After infecting Windows-based computers, the worm creates new users -- Harry Potter, Hermione Granger and Ron Weasley, the series' main characters.
When infected users open Internet Explorer, they are redirected to an Amazon.com Web page selling the spoof, "Harry Putter and the Chamber of Cheesecakes."
"Much of the world is waiting with bated breath for the final Harry Potter novel, and the premiere of the new movie is looming, too. There is a real danger that muggles will blindly allow their USB flash drives to auto-run and become infected by this worm," said Graham Cluley, Sophos senior technology consultant. "Using such social engineering at this time is a trick dastardly enough for Lord Voldemort himself."
Submitted by Graham Cluley (not verified) on Sun, 2007-07-01 12:41. *
The Hairy (Harry Potter) worm does not spread via email. It infects you when you attach an already-infected USB drive and allow it to auto-run. Some media are claiming the email element, but there is no mention of that on the Sophos website.
Disclaimer: The views and investment tips expressed by investment experts on themoneytimes.com are their own, and not that of the website or its management. TheMoneyTimes advises users to check with certified experts before taking any investment decision.
It doesn't spread via email
The Hairy (Harry Potter) worm does not spread via email. It infects you when you attach an already-infected USB drive and allow it to auto-run. Some media are claiming the email element, but there is no mention of that on the Sophos website.
Regards
Graham Cluley, Sophosh