Malware Authors Distribute Trojan-Embedded Animation Film

A malware is infecting PCs through a Trojan horse concealed in an animated video. The author of the malware is e-mailing the video to users worldwide, warns security researchers, as reported by Informationweek in news on June 27, 2007.

According to Sophos Labs, it is possible to package this new variant of Trojan dubbed Troj/Agent-FWO with a harmless but humorous Shockwave video. Bruno Bozzetto, the Italian animator of cartoon characters has created the movie. The all-favorite Shockwave animation video titled "Yes & No" has been moving across the Internet for several years and therefore it is not unlikely to find malware writers to target Shockwave Flash animation users in a situation like this. They have started to exploit people's interest in the video by distributing a copy of the same with a Trojan inscribed in it to as many users as possible. They know when users watch the video the Trojan will act as desired.

Bozzetto published the 'Yes & No' video on the Internet in 2001. It humors about obeying the road rules that do not necessarily make sense. It is believed that the online animation has had hundreds of thousands of viewers.

Sophos said the Trojan plants its injurious payload onto a Windows System folder and creates registry entries that run on starting up the system. It could also inject malicious code into system processes in order to evade detection.

The important point to note is that the animation as such is not harmful. A good many artists like Bruno Bozzetto have made funny videos, which could only be unappreciable if they require long hours of watching, said Graham Cluley, senior technology consultant for Sophos, as per the news reported by Sophos.com on June 26, 2007.

But the Trojan program with the animation in this case is dangerous. For, it is taking advantage of society's preference to forwarding humor-based animated films to near and dear ones, while they infect many recipients without the senders' knowledge, said Cluley.

Sophos explained how the Trojan runs the animation in the form of a smokescreen to hide its activity, that of quietly infecting Windows PCs.

Related article: Malware Authors Turn More Insidious

» SPAMfighter News - 7/7/2007