X

Malware targets 'Simpsons' fans on AIM

Dormant Simpsons-related AIM buddy comes alive this week, promising a Web-exclusive episode of the popular TV show but instead infecting the machine with software that turns it into a botnet zombie.

Elinor Mills Former Staff Writer
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service and the Associated Press.
Elinor Mills

Whatever you do, don't run that .exe file from "Chunkylover53," an alias for Homer Simpson.

Years ago, fans of The Simpsons added "Chunkylover53" to their AIM buddy list after learning that the writer-producer of the show was responding to fans in the voice of Homer from "Chunkylover53@aol.com."

Since then, the screen name has been inactive, until a few days ago when Chunkylover53's "Away" message appeared, prompting people to click on a link and run an executable in order to see "a *new* Internet-only exclusive Simpson's episode."

Of course, the file doesn't show a Simpsons video. It infects the machine with a Trojan that throws up error messages, crashes the computer when attempting to open Windows Explorer and drops other nasty files onto the machine, making it part of what is believed to be a Turkish botnet, according to FaceTime, which secures IM, collaboration and Web apps for corporations.

The long dormant "Chunkylover53" awoke this week with this "Away" message for Simpsons fans. Running the executable turns the PC into a zombie on a botnet. FaceTime

The message has been changed since it was first displayed earlier this week. On Thursday night, this is what it said. FaceTime