Users risk smackdown as WWE screensaver worm discovered, reports Sophos

March 15, 2005 Sophos Press Release

Experts at SophosLabs™, Sophos's global network of virus and spam analysis centres, have warned users to be on their guard against a worm which can disguise itself as a screensaver featuring two female stars of professional wrestling.

The W32/Elitper-D worm spreads via email pretending to be a bug fix for Microsoft Windows XP SP2. However, when it attempts to spread via file-sharing systems and internet relay chat it disguises itself as a screensaver of WWE divas Torrie Wilson and Sable. The two blonde stars of professional wrestling are known to WWE devotees around the world, and have graced the pages of Playboy magazine.

The W32/Elitper-D worm makes changes to the security settings of infected computers, and blocks access to various websites, potentially leaving the PC open to further attack.

"WWE is phenomenally popular amongst many young people, but a mystery to the rest of us," said Graham Cluley, senior technology consultant for Sophos. "Anyone who visits file-sharing systems and chatrooms looking for material related to their idols should exercise care about what they download. This isn't the first time that virus writers have used celebrities as bait, and sadly it won't be the last time that innocent users fall for the trick."

Sable, an ex-Guess Jeans model whose real name is Rena Mero, and Torrie Wilson have inspired tens of thousands of internet websites, many with extensive image galleries and movie clips.

Although there have been very few reports of the worm, Sophos recommends computer users ensure their anti-virus software is up-to-date, and that companies protect themselves with a consolidated solution which can defend them from the threats of both spam and viruses.