Pubdate: Tue, 10 Jul 2001
Source: Wired News (US Web)
Copyright: 2001 Wired Digital Inc.
Contact:  http://www.wired.com
Details: http://www.mapinc.org/media/1055
Author:  Brian McWilliams

SMOKING MAD OVER POT VIRUS

An annoying but relatively harmless virus that advocates legalizing 
marijuana is making enemies out of some potential allies: potheads.

Unlike Stoned, which appeared a dozen years ago and could corrupt all data 
on a disk drive, the Marijuana virus doesn't damage victims' PCs. Its 
payload, which is spread by an e-mail worm and through a Trojan Horse 
program, sets the infected computer's Internet Explorer browser start page 
to marijuana.com and places an unmistakable green, palmate leaf in the 
Windows system tray of an infected PC.

But the pro-cannabis code's method of spreading the message has made some 
ordinarily docile dope smokers decidedly un-mellow. Some of the responses 
posted on the message boards at marijuana.com have been downright aggressive.

"We've actually had to put up a firewall because of increased attacks we've 
seen on our server," said Rick Garcia, webmaster of marijuana.com, an 
informational site, which calls itself "The Internet's Answer To The Drug War."

The site is "absolutely not responsible" for the virus, according to 
Garcia, who reports that in addition to lighting up the site's online 
discussion board 25 to 50 times per day with their misdirected complaints, 
some angry victims have gone so far as to launch denial-of-service attacks 
against the server.

According to antivirus research and software firm Kaspersky Lab, which has 
assigned the worm the name I-Worm.Mari, the code is making the rounds as an 
e-mail with the subject line "check this out!"

Those who fall for its lame attempt at social engineering and click on the 
attachment -- a file named system32.exe, written using Microsoft's Visual 
Basic -- will propagate the worm to every address in their Microsoft 
Outlook e-mail address book.

But the primary vector for the spread of the Marijuana virus appears to be 
a Trojan Horse program named Weed Farmer, which trades on the popularity of 
a legitimate PC game called Ganja Farmer, in which players defend their 
crop against drug enforcement agents in helicopters, with the aid of a 
20-millimeter machine gun mounted on a 1969 VW microbus.

Weed Farmer, on the other hand, which has been circulating among users of 
the Morpheus peer-to-peer file-trading program among other places, contains 
no actual game code and is merely the Marijuana virus renamed to look like 
the rasta shoot-'em-up game.

According to Bruce Hughes, antivirus lab manager for ICSA Labs, the 
Marijuana virus is the latest in a category of computer viruses that try to 
promulgate a political message through self-replication. While most fail to 
travel widely, one such program, a worm called Mawanella, warranted a "high 
risk" rating by several antivirus vendors when it began to spread quickly 
in May. Mawanella carried a cryptic message about genocide against Muslims 
in Sri Lanka.

Click on the pot leaf in the system tray of a PC infected with the 
Marijuana virus and the code will exhale a mini-diatribe on why marijuana 
should be legalized in North America.

"I do hope somebody, somewhere listens to what I have to say and does not 
just regard this as just another virus because it's more then (sic) that, 
it's a message, a message for freedom," pleads the author of the virus, who 
considerately coded the program to pop up a message box twice a day, 
reminding the user: "Time to toke up :)."
- ---
MAP posted-by: Jay Bergstrom