Pay-per-click porn worm plays havoc

Security watchers have warned web users to be on their guard against a scam artist who is using a porn spreading worm to rack up cash on pay-per-click sites.

The 'Fortnight' worm has been identified as a piece of malicious Javascript in a number of web pages. Whenever a visitor browses one of these pages the worm will insert code into the Outlook Express signature file.

Every time the infected user sends an email, a link to a pay-per-click porn site will appear at the bottom of the message.

If the recipient of the mail is capable of receiving HTML emails, then the porn website could be launched automatically.

To add insult to injury, the malicious Javascript code also sets Internet Explorer's (IE's) homepage to the porn site and adds a number of similar sites into the favourites and bookmarks of IE and Netscape Navigator.

The site in question, rawtocash.net, appears to have been pulled by Russian hosting provider Maverick, but there may still be some infected pages out there.