Virus writer sends a leaf out of users' address books

Security experts have warned UK companies of an email worm, which promotes the use of cannabis.

When activated, the worm, titled W32/Marijuana, attempts to email itself to every address in a users' Outlook address book with the subject "check this out!!!".

The worm copies itself to system32.exe in the Windows directory, and sets the registry key HKLM\Software\Microsoft\Windows \CurrentVersion\Run\System32. Subsequently, the worm sets the Internet Explorer home page to http://my.marijuana.com and changes the Windows registered owner to "Im A Pot Head!", and the organisation to "Stoner's Pot Palace". It puts an icon of a marijuana leaf in the system tray.

According to anti-virus expert Graham Cluely from Sophos, the worm is yet another example of campaigning by hactivists. He said: "The marijuana worm is a good example of a virus writer launching a politically motivated campaign and trying to spread his message. However, it does not seem to have infected too many companies here in the UK."