With the release of the final Harry Potter novel due in the next few weeks, and the imminent premiere of the fifth Harry Potter movie, Internet security firm Sophos has warned of a new computer worm exploiting Potter-mania around the world.

The W32/Hairy-A worm can automatically infect a PC when users plug-in USB drives, which carry a file posing as a copy of the eagerly anticipated novel, “Harry Potter and the Deathly Hallows”. If the users have allowed USB drives to ‘auto-run’ they will see a file called HarryPotter-TheDeathlyHallows.doc

Inside this Word document file is the simple phrase “Harry Potter is dead.” The worm then looks for other removable drives to infect.

After infecting Windows computers, the worm creates a number of new users – namely the main characters from JK Rowling’s Harry Potter books, being Harry Potter, Hermione Granger and Ron Weasley. After logging in, users are shown the following message via a batch file:

read and repent

the end is near
repent from your evil ways O Ye folks
lest you burn in hell...JK Rowling especially

In addition, everytime infected users open Internet Explorer they will find their start page has been redirected to an Amazon.com web page selling a spoof book entitled “Harry Putter and the Chamber of Cheesecakes”.

“Much of the world is waiting with bated breath for the final Harry Potter novel, and the premiere of the new movie is looming too. There is a real danger that muggles will blindly allow their USB flash drives to auto-run and become infected by this worm,” said Graham Cluley, senior technology consultant for Sophos.

Unlike most malware written today, the Hairy worm does not appear to have been written with financial reward in mind.

“This is an ‘old school’ virus, written to give the author a platform to show off rather than to steal identities or cash,” said Cluley.

“This person isn’t being driven by the desire to inflate his or her bank account, but by a loathing for JK Rowling and her incredibly popular books.

“Someone needs to get a little more sunshine in their diet and put their energies into a more positive pursuit than writing malicious code like this.”

Related:

Entry was posted on Saturday, June 30th, 2007 at 12:26 pm under Internet, Security.

Read more entries by John Pospisil.
Stumble It!