Bogus F-Secure emails hide nasty worm

Worm variant installs a backdoor to allow remote control of the PC

Antivirus firm F-Secure has issued a warning about a rash of spoof emails purporting to come from its researchers.

The emails, apparently from a 'David Adams' at F-Secure, tell the recipient that they are having problems with their browser, and include a screenshot in a .zip file.

But the file contains a new worm variant called Breplibot.AE which installs a backdoor to allow remote control of the PC. It also attempts to shut down any security software running on the machine.

The email reads: 'I noticed whilst browsing your site that there were problems with some of your links, when I tried again with Internet Explorer the problems were not there so I assume that they were caused by me using the Mozilla browser.

'As more people are turning to alternative browsers now it may be of help for you to know this. I have enclosed a screen capture of the problem so your team can get it fixed if you deem it an issue.'

F-Secure has confirmed that it has no employee by the name 'David Adams' and does not distribute emails with attachments to its customers in this way.

"There is a mass spamming underway right now. Some emails were also spoofed from editor@f-secure.com or from info@f-secure.com," said Mikko Hyppönen, chief research officer at F-Secure on the company's blog. 

"The emails are not sent from our network. They are just spoofed to look like they are coming from an F-Secure address."