According to Sophos, the Dref-N worm, which arrives attached to e-mails with subject lines such as 'White house news!', 'Incredible news' and 'ATTN TO EVERYBODY!, tries to dupe recipients by claiming that the attachment contains details of a major global news story. The e-mail text itself could include any of the following:
 
'3rd Glogal War Just Started!!! Read more in file!'
'Nuclear War in Russia! Read news in file!'
'President Bush DEAD! Read attached file!'
'Putin and Bush starts NUCLEAR WAR! Check the file!'
'Nuclear WAR in USA! Read attached file!'
'GLOBAL NUCLEAR WAR JUST STARTED! News in file.'
'President Putin dead! Read more in attached file!'
 
Opening the attached file disables the Windows firewall, and allows external hackers to gain access to the PC, in order to spy, steal or cause havoc.
 
Users may think that they are receiving these e-mails from their friends, family and colleagues, but in fact it is a worm that has infected the sender's computer and distributed the message.
 
"While many of these news hooks may sound totally implausible, it is amazing how many users still get tempted, and click on the infected file, says Brett Myroff, CEO of Sophos master distributor, NetXactics. The simple advice is that if anyone suspects that there is a breaking news story, they should turn on the TV or visit their favourite news Web site to see if it has any basis in truth.
 
Sophos recommends that companies automatically update their corporate virus protection, and run a consolidated solution at the e-mail gateway to defend against viruses, spyware and spam.