Fake CNN Newsletter On London Blasts Contains Trojan Virus

We already knew that the virus authors are using each event that has a major social impact in order to infect as many computers as possible. And it looks like the tragic events that took place last Thursday in London have offered hackers yet another possibility of spreading a new virus.

Thus, they have created a Trojan, which appears in the form of an alleged newsletter from CNN with the title "TERROR HITS LONDON", which is supposed to contain video clips shot by amateurs as the events unfolded.

The email, sent from breakingnews@cnnonline.com, invites the users to open an attachment, which should contain a video file. The file name, "London Terror Moovie.avi" appears a valid film clip bar the typo in "movie", however after 124 character spaces there is the real .exe file name, though even this has been disguised as "Checked By Norton Antivirus.exe".

Once started, the program copies itself in /Windir/winlog.exe and modifies the Windows registry, namely the registry value HKLM/Software/microsoft/Windows/CurrentVersion/Run, such that it can run on startup, as reported by MessageLabs, the email security company that has identified the virus. The Trojan then transforms the computer into a "zombie" system, which can be used by the hackers for sending a huge amount of spam messages.