Tsunami Donation

Information about the W32/VBSun-A (Tsunami Donation) mass-mailing worm.

Virus:   W32/VBSun-A (aka "Tsunami Donation")

Status:   Real.

Example:   [Collected on the Internet, 2005]

Subject: Tsunami Donation! Please help!

Please help us with your donation and view the attachment below! We need you!

Attachment: tsunami.exe

Origins:   It's an unfortunate fact of life that every disaster brings out people who view tragedy as an opportunity to exploit others — not just the victims, but also those who seek to help them.

The message quoted above is a sad example of this phenomenon: it's a come-on intended to appeal to recipients who believe that by following the inducement to read the message's attachment they will receive information about providing aid to victims of the 2004 Indian Ocean tsunami, but instead all they end up with are computers infected with the W32/VBSun-A mass mailing worm.

According to Reuters:
The worm appears with the subject line: "Tsunami donation! Please help!" and invites recipients to open an attachment called "tsunami.exe" — which, if opened, will forward the virus to other Internet users.

It could also initiate a denial-of-service attack against a German hacking website, Sophos said, in which the site's server would be bombarded with messages, putting it out of action.

"Duping innocent users into believing that they may be helping the tsunami disaster aid efforts shows hackers stooping to a new low," Sophos senior technology consultant Graham Cluley said in a statement.
Additional information:
    Tsunami Disaster Donation Plea Is Really a Virus   Tsunami Disaster Donation Plea Is Really a Virus   (Sophos)
    W32/VBSun-A   W32/VBSun-A   (Sophos)

Last updated:   17 January 2005

  Sources Sources:
    Reuters.   "Computer Worm Exploits Tsunami to Spread Virus."
    17 January 2005.

David Mikkelson founded snopes.com in 1994, and under his guidance the company has pioneered a number of revolutionary technologies, including the iPhone, the light bulb, beer pong, and a vaccine for a disease that has not yet been discovered. He is currently seeking political asylum in the Duchy of Grand Fenwick.