Would your heart race at the sight of a file called Real kamasutra.pps.exe?
Would you think, "Oooh.. s.exe!" or would it be a turn off?
One piece of malware we saw earlier this week certainly hopes that you would be interested in a PowerPoint presentation demonstrating different sexual positions, and would be tempted into clicking.
Well, be careful what you do with that mouse.
The slides, which would probably raise an eyebrow if viewed in your office (thank heavens my monitor faces the wall) shows thirteen different ways to make love - some with fanciful names such as "The Frog", "Wheelbarrow" and "Lyons Stagecoach". And there I was thinking there were a lot of malware variants..
The malware comes as a file called Real kamasutra.pps.exe (the old double-extension trick). In other words, you may think you are directly opening a PowerPoint slideshow, but in fact you're running an executable program.
The PowerPoint slide deck (which ironically is itself "clean" from the malware point of view) is then dropped onto your Windows PC as a decoy while malware silently installs onto your computer as AdobeUpdater.exe, alongside some other components (called jqa.exe and acrobat.exe).
Because of this, when you click on the file you do get to see a real PowerPoint presentation, but in the background a backdoor Trojan (no sniggering at the back please..) called Troj/Bckdr-RFM is installed which allows hackers to gain remote access to your computer.
Once they have broken into your computer, they can use it to relay spam around the world, steal your identity, spy on your activities, install revenue-generating adware or launch denial of service attacks.
Remember - don't rush to click on unknown files, you could be opening yourself up to all kinds of unwanted attention.
![Password security infomerical leaves Ellen DeGeneres in disbelief.. and it will you too [VIDEO]](http://sophosnews.files.wordpress.com/2013/04/ellen-thumb.jpg?w=75&h=75&crop=1)
![Can multiple moving cursors really hide your password from spyware and peepers? [VIDEO]](http://sophosnews.files.wordpress.com/2013/03/cursors-thumb.jpg?w=75&h=75&crop=1)
![Hacked TV channels broadcast zombie apocalypse emergency alert [VIDEO]](http://sophosnews.files.wordpress.com/2013/02/zombie-thumb.jpg?w=75&h=75&crop=1)
"No sniggering at the back please." Sense of humour! I missed it at first though... :D
May I snigger now? The headline is just too funny.
rofl!!
I'm thinking you've got too many words here:
"Once they can gain break into your computer"
Good article though.
Thanks. I've fixed the article to correct that.
It's good to know that someone was reading the words rather than just trying to magnify and depixelate the pictures.. :)
While we're at it;
...allows hackers to gain remote access of your computer....
Would read better as:
...allows hackers to gain remote access to your computer....
Oh I already ran the Depixelator 5000 on those. Kinky stuff! :)
Why, oh why, is Windows set to "Hide Extensions" by default?
Because most users will rename a file and not put an extension, then ignore the warning "Are you sure you want to change the extension? You may make the file unreadable."
For awhile at my work we had extensions turned on in our base image. Users would change a file's .doc extension to .jpg to "show someone their document". I kid you not.
Love the headline Graham. A real attention getter. lol
I guess the message you are trying give us here Graham is that we should practise safe hex.
Or would that be too geeky for most people to get? :-)
looks shocking :S
Would it kill you to make that slide full size so we could at least see it? :-)