Britain: Homepage Virus Hits

greenspun.com : LUSENET : Grassroots Information Coordination Center (GICC) : One Thread

BBC

Wednesday, 9 May, 2001, 15:17 GMT 16:17 UK Porn virus hits computers

Virus has already hit e-mail systems at the Australian parliament A computer virus that directs people to pornographic websites is clogging computers around the world.

The Homepage virus arrived in Britain from the Far East and Australia this morning hitting media and financial companies in London.

Now anti-virus firms fear the outbreak will worsen as the US awakes and people open infected e-mail messages that arrived overnight. The outbreak looks set to be one of the biggest of 2001.

After examining the virus, and the webpages it sends people to, some experts are beginning to wonder if it is a misguided attempt to drum up traffic for the sites peddling porn.

Virus anniversary

Almost exactly a year after the Love Bug computer virus caused havoc around the world, a similar virus, called Homepage, is doing the rounds and hitting some companies hard. The email systems at Parliament House in Canberra were reportedly one of the first infected by it.

Graham Cluley, from anti-virus company Sophos said 80 companies have said they have been hit by the virus, and several fear they have despatched up to 100,000 infected e-mails.

He said that the outbreak could worsen as America wakes up and people start to read their e-mail. "Viruses tend to travel with the sun," he said, adding that Homepage is on the way to being one of the biggest viruses of the year.

Anti-virus firm MessageLabs said it was catching more copies of Homepage than the recent Kournikova virus. So far the virus does not look like it hit as many people as the Love Bug did.

'Subject: Homepage'

The Homepage virus uses the same tricks as the Love Bug and the Kournikova virus and attaches a pernicious payload to an innocuous looking message. It will only affect users of Microsoft's Outlook e-mail program.

The e-mail message carrying the virus is tagged with the subject "Homepage", and in the message body it says: "Hi! You've got to see this page! It's really cool ;O)". The attachment is called "homepage.html.vbs."

The virus does not damage or delete files but the number of e-mail messages it generates could overwhelm some networks.

Technically the virus is known as a worm because it reproduces as it moves across a network. By contrast trojan horses are viruses that look benign but contain a damaging payload.

Anyone clicking on the attachment will find themselves visiting one of four pornographic websites. The virus also changes the default page of Internet Explorer to one of the four porn sites.

Some anti-virus companies are now wondering if the Homepage virus could be a severely misguided attempt to boost the number of visitors to the quartet of websites, all of which were set up by the same person. The sites reportedly offer pornographic pictures in return for a fee paid by credit card.

"We are wondering if the pages have been set up by kids who have written a virus to generate traffic and make money," said Mr Cluley, "if that is what has happened then that is unbelievably dumb."

Tracking down the owners of webpages and people who have contracts with credit card clearing companies is very straightforward, said Mr Cluley, and could lead police to the virus writer.

-- Rachel Gibson (rgibson@hotmail.com), May 09, 2001


Moderation questions? read the FAQ