Trojan Horse Dropped by Spoofed Email from Anti Child Pornography Organization

Both the Association of Sites Advocating Child Protection and Sophos have issued press releases informing of spoofed emails apparently generated by the ASACP that carry the Troj/Agent-CPK Trojan Horse. Spammed emails with "CP investigation was started" contain a .zip archive dubbed "asset576.zip"and an asset.txt.exe file that actually installs the malware.

"I'd like to inform you that investigating activity of the one of child porno sites; we found e-mails data base, in which was your e-mail . In view of this, I have two versions: either you are the client of this shop, or your e-mail appeared there accidentally. I sincerely hope that it was accidental coincidence and believe that you are interested in this version as well. If you show a good will, make modest, voluntary donation on our site: http://www.asacp.org/donation.html, I will be convinced in your being not implicated in this business," reads part of the email.

"The danger is that people may panic when they think their email address was found on a child abuse website, rush to open the attached file and become infected by a malicious Trojan horse," said Graham Cluley, senior technology consultant for Sophos. "The ASACP are an entirely innocently party in this attack, it is simply their name which is being spoofed by the hackers in their attempt to infect innocent computer users."