Thousands of PCs Infected by Nasty Trojan Horse

Malicious Trojan horse software claiming to provide information on topics like the deadly storms that have battered Europe this week has infected thousands of computers over the past 24 hours, security vendor Sophos warned today.

The e-mail tries to entice victims into clicking on the malicious attachments by offering reports on breaking-news topics such as "230 dead as storm batters Europe," or "U.S. Secretary of State Condoleeza Rice has kicked German Chancellor," said Graham Cluley, a senior technology consultant with Sophos.

The attachments have names such as "Full Story.exe" or "Full Video.exe." Once they are launched, these files install software that then waits to receive further instructions over the Internet, Cluley said. Unlike a worm, this Trojan software does not immediately seek out other targets to infect once it has been installed.

"You think you're reading a news report or you're watching a movie," he said. "It's the age-old technique that we've seen since the mid-1990s: Here's something you want to look at. Look here!"

Cluley estimates that the Trojan accounted for about one of every 200 e-mail messages being sent on the Internet today.

Topical and Effective

These messages appear to have been particularly effective because they offer information on a topic that is of intense public interest in Europe right now. Over the past few days storms in northern Europe have caused widespread damage and killed close to 40 people.

Symantec, one of the biggest PC security firms, says it has seen this particular Trojan variant in circulation since Wednesday, and has counted "thousands" of infections since then. "It's not a small threat, but it isn't an epidemic either," said Dave Cole, a director with Symantec Security Response.

This latest Trojan--rated as a "medium" threat by Symantec--is no more widespread than other similar outbreaks over the past year, but it has raised eyebrows by coming on so quickly, security experts said.

Some customers were finding that the Trojan was accounting for as much as 10 percent of all their incoming e-mail yesterday, said Adam O'Donnell, a senior research scientist at Cloudmark, a messaging security firm. "It's not as bad as some other ones," he said. "It just sped up so quickly, it caught some people by surprise."