Porn Spam Thrusts Pushu Trojan onto Users’ PCs

IT security company Sophos has sent out a warning that spammers were distributing e-mails apparently to offer users free pornography.

The catch in the e-mail containing phrases like 'hot photos from my birthday' is an URL link, which directs the recipient to a phishing site hosting a Trojan called Pushu-A. The Trojan tries to capture information from the victims' infected PCs.

Troj/ Pushu-A is the Trojan compatible with Windows. It enables remote access to the PC, downloads malware from the Net, steals private data of users, diminishes security in the system and places itself in the Registry.

The phishing site instructs the visitors to download a certain number of supposedly hardcore adult images archived in a file. But the file is really a malicious executable dubbed xxx.exe or foto.exe, according to Sophos. When experts at SophosLabs were investigating one such site containing the malware, they found photographs of Lewis Black and Dave Attell, two U.S. comedians. Peculiarly these didn't seem to relate to the spam mail, not even the malicious code.

The danger with such lustful messages is that people in their excitement to view the porn images often click before giving thoughts about their computers' health, said Graham Cluley, senior technology consultant at Sophos in a company press release that the company published on March 26, 2007. There is a strange turn due to the comic photographs though computer owners are not likely to laugh if the Pushu download compromises their PCs.

The spam mail campaign has received wide distribution although Sophos hasn't received too many reports that the Trojan horse had infected users, Cluley continued. He said visitors to the fake porn websites risk exposing their systems to cyber criminals whose objective is to steal confidential information or execute more online attacks. But there is hope that the continued success of the spam will temper people's temptations for such illicit material mitigating infection for at least some time in the immediate future.

Like several times before, Sophos has again reminded companies to update their main virus protection and execute a compact solution to defend against spyware, viruses and spam.

Related article: Porn Links Overflow Irish Message Boards

» SPAMfighter News - 4/3/2007