Death by PowerPoint? Kama Sutra presentation leads to backdoor infection

Filed Under: Malware

KamasutraWould your heart race at the sight of a file called Real kamasutra.pps.exe?

Would you think, "Oooh.. s.exe!" or would it be a turn off?

One piece of malware we saw earlier this week certainly hopes that you would be interested in a PowerPoint presentation demonstrating different sexual positions, and would be tempted into clicking.

Well, be careful what you do with that mouse.

Kamasutra PowerPoint slides lead to backdoor infection

The slides, which would probably raise an eyebrow if viewed in your office (thank heavens my monitor faces the wall) shows thirteen different ways to make love - some with fanciful names such as "The Frog", "Wheelbarrow" and "Lyons Stagecoach". And there I was thinking there were a lot of malware variants..

The malware comes as a file called Real kamasutra.pps.exe (the old double-extension trick). In other words, you may think you are directly opening a PowerPoint slideshow, but in fact you're running an executable program.

The PowerPoint slide deck (which ironically is itself "clean" from the malware point of view) is then dropped onto your Windows PC as a decoy while malware silently installs onto your computer as AdobeUpdater.exe, alongside some other components (called jqa.exe and acrobat.exe).

Because of this, when you click on the file you do get to see a real PowerPoint presentation, but in the background a backdoor Trojan (no sniggering at the back please..) called Troj/Bckdr-RFM is installed which allows hackers to gain remote access to your computer.

Once they have broken into your computer, they can use it to relay spam around the world, steal your identity, spy on your activities, install revenue-generating adware or launch denial of service attacks.

Remember - don't rush to click on unknown files, you could be opening yourself up to all kinds of unwanted attention.

, , , , ,

You might like

13 Responses to Death by PowerPoint? Kama Sutra presentation leads to backdoor infection

  1. icyrus88 · 1731 days ago

    "No sniggering at the back please." Sense of humour! I missed it at first though... :D

  2. ray · 1731 days ago

    May I snigger now? The headline is just too funny.

  3. Guest · 1731 days ago

    I'm thinking you've got too many words here:
    "Once they can gain break into your computer"
    Good article though.

    • Thanks. I've fixed the article to correct that.

      It's good to know that someone was reading the words rather than just trying to magnify and depixelate the pictures.. :)

      • Guest · 1731 days ago

        While we're at it;
        ...allows hackers to gain remote access of your computer....
        Would read better as:
        ...allows hackers to gain remote access to your computer....

      • Guest · 1730 days ago

        Oh I already ran the Depixelator 5000 on those. Kinky stuff! :)

  4. Mark · 1731 days ago

    Why, oh why, is Windows set to "Hide Extensions" by default?

    • Guest · 1730 days ago

      Because most users will rename a file and not put an extension, then ignore the warning "Are you sure you want to change the extension? You may make the file unreadable."
      For awhile at my work we had extensions turned on in our base image. Users would change a file's .doc extension to .jpg to "show someone their document". I kid you not.

  5. Love the headline Graham. A real attention getter. lol

  6. Craig · 1731 days ago

    I guess the message you are trying give us here Graham is that we should practise safe hex.

    Or would that be too geeky for most people to get? :-)

  7. looks shocking :S

  8. Greg · 1461 days ago

    Would it kill you to make that slide full size so we could at least see it? :-)

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley