Harry Potter worm claims wizard is dead

By

Hackers cash in on J K Rowling hype.

Harry Potter worm claims wizard is dead
Security experts have warned of a newly intercepted worm that carries its malware payload in a file purporting to be a copy of Harry Potter and the Deathly Hallows.

The Hairy-A worm can automatically infect a PC when users plug in USB drives, which carry a file posing as a copy of the eagerly anticipated book.

If the users have allowed USB drives to 'auto-run' they will see a file called 'HarryPotter-TheDeathlyHallows.doc'. Inside this Word document is the simple phrase 'Harry Potter is dead'.

The worm looks for other removable drives to infect and attempts to create a number of new users on infected computers.

These 'new users' appear as the main characters from J K Rowling's celebrated series, namely 'Harry Potter', 'Hermione Granger' and 'Ron Weasley'.

After logging in, users are shown the following message via a batch file:
'read and repent
the end is near
repent from your evil ways O Ye folks
lest you burn in hell...JK Rowling especially'

"Much of the world is waiting with bated breath for the final Harry Potter novel, and the premiere of the new movie is looming too," said Graham Cluley, senior technology consultant at Sophos.

"There is a real danger that Muggles will blindly allow their USB Flash drives to auto-run and become infected by this worm."

The worm's final trick is that every time infected users open Internet Explorer, they will find their start page has been redirected to a spoof Amazon.com web page selling a book entitled 'Harry Putter and the Chamber of Cheesecakes'.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Log In

  |  Forgot your password?