Avril Lavigne Worm Needn’t Be So Complicated, Says Sophos

Sophos, a world leader in corporate anti-virus protection, has received a number reports of a new worm called Avril or Livra (W32/Avril-A) circulating in the wild.

The worm, which is a tribute to Canadian skater chick, Avril Lavigne, will open Microsoft Explorer on her website, on the 7th, 11th and 24th of the month. The worm also takes advantage of a year old vulnerability in Microsoft Outlook, which allows it to forward itself to all email addresses in Outlook regardless of whether the email attachment is opened or not.

Amongst the various subject lines the worm uses is ‘Fw: Avril Lavigne – the best’. Once the attachment is run, the worm attempts to disable the users anti-virus software. It also behaves in the 80’s film stereotype of viruses, by taking over the screen with a series of coloured ellipses.

“Ms Lavigne is just the latest in a long line of pop idols and celebrities to be used as bait by virus writers,” said Carole Theriault, anti-virus consultant at Sophos Anti-Virus. “It seems that every time a new celebrity bursts onto the scene, a virus writer will use them to persuade unsuspecting computer users to open unsolicited emails.”

“The message to computer users is not so complicated. Those who practise safe computing, keep their anti-virus software up to date and patch against operating system vulnerabilities, will dramatically reduce the risk of becoming infected by a new virus,” continued Theriault.

More information about W32/Avril-A can be found at www.sophos.com/virusinfo/analyses/w32avrila.html