Bin Laden virus threatens hard drive data

Security experts have intercepted a malicious worm that threatens to erase all data on infected PCs hidden in emails allegedly containing videos of Osama Bin Laden.

The Famus-F worm (W32/Famus-F) has been discovered in the wake of George W Bush's re-election as US president, and less than a week after an Arabic television station broadcast the first videoed speech by Al Qaeda leader Bin Laden since the US-led war in Afghanistan.

The worm arrives in the form of a bilingual English and Spanish email, with the subject line: 'More terrorism this year.'

The message body reads: 'Last speech from Bin Laden. Please forwards this video to everybody.' It includes a password 'cnn'.

If executed, the worm attempts to forward itself to email addresses found on infected computers and drops a number of files onto the hard drive.

Hidden inside the virus is some Spanish text which translates into English as: 'This computer has been infected with the LIBERTAD (FREEDOM) virus. This is to protest against the violation of free expression rights. Now all the data in your hard drive is been erased The Hobbit.'

Graham Cluley, senior technology consultant at Sophos, said: "Hackers and virus writers will try all kinds of topical tricks to entice people into running their malicious code. It seems this time that the virus writer has focused on the public's appetite for breaking news on the war against terror.

"There will be many who will be interested to know how terrorists will react to George W Bush's success at the polls. Those people should not lower their guard and be fooled into accepting unsolicited email attachments."

Reassuringly, according to Cluley, the Famus-F worm is not yet spreading very successfully. "We have only detected a handful of incidents at the moment in the UK and Spain. It is not in the top 20," he told vnunet.com.

Sophos information on W32/Famus-F