F-Secure Virus Descriptions : Noped

    Subject:    FWD: Help us ALL to END ILLEGAL child porn NOW
    Body:       Hi, just a quick e-mail. Please read the attached document as soon as you can.
                Thanks.
    Attachment: END ILLEGAL child porn NOW.TXT............vbe

or in a message that have a completely random subject, body and attachment name.

When executed, the worm shows the following text in Notepad:

--- Begin Worm Message ------------------------------------------

    In 1977 the Sexual Exploitation of Children Act (18 U.S.C.
    2251-2253) was enacted. The law prohibits the use of a minor in
    the making of pornography, the transport of a child across state
    lines, the taking of a pornographic picture of a minor, and the
    production and circulation of materials advertising child
    pornography. It also prohibits the transfer, sale, purchase, and
    receipt of minors when the purpose of such transfer, sale,
    purchase, or receipt is to use the child or youth in the
    production of child pornography. The transportation, importation,
    shipment, and receipt of child pornography by any interstate
    means, including by mail or computer, is also prohibited

    The Child Protection Act of 1984 (18 U.S.C. 2251-2255) defines
    anyone younger than the age of 18 as a child. Therefore, a
    sexually explicit photograph of anyone 17 years of age or younger
    is child pornography.

    On November 7, 1986, the U.S. Congress enacted the Child Sexual
    Abuse and Pornography Act (18 U.S.C. 2251-2256), that banned the
    production and use of advertisements for child pornography and
    included a provision for civil remedies of personal injuries
    suffered by a minor who is a victim. It also raised the minimum
    sentences for repeat offenders from imprisonment of not less than
    two years to imprisonment of not less than five years.

    On November 18, 1988, the U.S. Congress enacted the Child
    Protection and Obscenity Enforcement Act (18 U.S.C. 2251-2256)
    that made it unlawful to use a computer to transmit advertisements
    for or visual depictions of child pornography and it prohibited
    the buying, selling, or otherwise obtaining temporary custody or
    control of children for the purpose of producing child
    pornography.

    On November 29, 1990, the U.S. Congress enacted 18 U.S.C. 2252
    making it a federal crime to possess three or more depictions of
    child pornography that were mailed or shipped in interstate or
    foreign commerce or that were produced using materials that were
    mailed or shipped by any means, including by computer.

    With the passage of the Telecommunications Act of 1996, (18 U.S.C.
    2422) it is a federal crime for anyone using the mail, interstate
    or foreign commerce, to persuade, induce, or entice any individual
    younger than the age of 18 to engage in any sexual act for which
    the person may be criminally prosecuted.

    The Child Pornography Prevention Act of 1996 amends the definition
    of child pornography to include that which actually depicts the
    sexual conduct of real minor children and that which appears to be
    a depiction of a minor engaging in sexual conduct. Computer,
    photographic, and photocopy technology is amazingly competent at
    creating and altering images that have been “morphed” to look like
    children even though those photographed may have actually been
    adults. People who alter pornographic images to look like children
    can now be prosecuted under the law.

--- End Worm Message --------------------------------------------

The worm changes also the Internet Explorer title bar text to:

    |.,.-*^*-.,.\ FUAHACKEDU@888.NU /.,.-*^*-.,.|

Next the worm sends itself within above mentioned messages to random number of recipients listed in the Outlook address book. This worm also collects a list of files with extension ".jpg" or ".jpeg" and sends this list to several fixed email addresses.

[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure; May 2001]