Virus hidden in McVeigh execution 'video'

In an attempt to see video footage of the execution of US mass murderer Timothy McVeigh, some internet users unwittingly installed a malicious virus on to their computers.

McVeigh was convicted of planting a bomb in Oklahoma City in 1995 which killed 168 people. He was executed by lethal injection on 11 June.

Hours after his death, some participants in an internet chat room followed a web link to see a video of the execution. Instead, the page launched an attack which downloads and installs an executable file on to victims' hard disks containing the SubSeven program.

SubSeven, which was identified by Symantec Antivirus Research Center, typically infects PCs by posing as a harmless email attachment. The program allows an attacker to retrieve saved and cached passwords and to decrypt some of them to modify registry settings and manipulate files from a remote system.

Bradley Chapman, a student at Brigham Young University, told US reporters that he stumbled across the "mcveigh" channel early on Tuesday morning and was immediately greeted with an automated message inviting him to visit the booby-trapped web page.

Chapman, a computer science major, did not run the program, but contacted several of the service providers involved and notified them about the attack.

Both America Online and MSNBC.com, which reported three to four times the normal traffic at their interactive forums, said that online chat focused largely on topics like the death penalty and reported nothing unusual.

A spokesman for Symantec said that, at this point, the company could not confirm if this variation of the SubSeven Trojan horse exists. "We have not received any submissions to date," he said.

But he did point out that Symantec has seen an increase in virus writers using social engineering to lure PC users to click on an attachment, and recommends that users update their virus definitions to ensure protection against SubSeven.