A new worm highlights the increasing political turmoil in the South American country of Bolivia. The worm, W32/Colevo-A, continually points the web browsers of infected computers to a variety of pictures of Evo Morales, leader of the Bolivian coca leaf growers' union and runner-up in last year's presidential elections.
Bolivia is one of the world's largest producers of the coca leaf, the raw material for cocaine. The government of Bolivia, with financial encouragement from the United States, has initiated a crop-eradication programme. However many of Bolivia's poorest farmers, led by Morales, are incensed because the coca leaf is often their only source of income. The dispute has become bloody, with armed conflict between the army and some coca leaf growers.
As well as redirecting web browsers to pictures of Evo Morales, the worm also makes numerous changes to the Windows Registry and appends the following text to the WIN.INI system file:
Viva el EVO, y jamas erradicaran la Coca Cola!!! mentira colla maldito!!
which translates as:
Long life to EVO and Coca Cola will never be eradicated!!! that's a lie, bloody colla!!
"The Colevo worm is another example of how virus writers are trying to use their creations to spread political messages," said Graham Cluley, senior technology consultant at Sophos. "Where once people may have sprayed graffiti on a brick wall we are now seeing more activists spreading messages via computer malware."
Previous politically-motivated viruses include the Injustice worm (also known as VBS/Staple-A), which disseminated pro-Palestinian messages and spammed a number of Israeli government email addresses, and Mawanella (also known as VBS/VBSWG-Z) which highlighted friction between Muslims and Buddhists in Sri Lanka.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.