New virus diguised as Saddam Hussein death.

A new worm is posing as photographic evidence that Saddam Hussein has been killed following an attempted escape bid from custody. The Bobax-H worm spreads both via email and using a Microsoft security vulnerability in the style of the infamous Sasser worm. Emails generated by the Bobax-H worm can use a variety of different message texts including: 'Saddam Hussein--Attempted Escape, Shot dead, Attached some pies that i found'.

Some versions also claim to have pictures of a captured Osama Bin Laden. Users who run the attached file on a Windows computer risk infecting their PCs. The worm will then attempt to forward itself onto other email addresses and vulnerable computers, attempt to disable anti-virus and security software, and install an email relay module which can be used by external hackers for sending spam. The Bobax-H worm exploits the same LSASS vulnerability first reported by Microsoft on 13 April 2004 in Microsoft Security Bulletin MS04-011, and later exploited by the widespread Sasser worm.

www.sophos.com