A form of malware has been seen in the wild which sniffs and publishes the user's net history on a public website before demanding a fee for its removal.
The Japanese trojan Kenzero installs itself on computers using a popular filesharing service called Winni.
It mysteriously targets those who download illegal copies of Hentai, which are pornographic cartoons (tentacles optional). It requests the victim's personal details as part of the download process.
It then takes screengrabs of the user's web history and publishes it online in their name, before sending an e-mail or pop-up screen demanding a credit card payment of 1,500 yen (about $17) to "settle your violation of copyright law" and remove the webpage.
Many victims have paid up in Japan where a loss of honour is often viewed as an unbearable humiliation.
While big content might stoop so low as to blackmail filesharers, in this case it is unlikely. The outfit where the history is published is owned by a shell company called Romancing Inc. It is registered to a fictitious individual called Shoen Overns.
This pseudonym has popped up before in association with the Zeus and Koobface trojans and is an established criminal gang that is continuously involved in this sort of thing, according to insecurity firm Trend Micro, which has been tracking Kenzero infections.
There is a similar problem in the EU, where a fictitious organisation calling itself the ICPP Copyright Foundation issues threatening pop-ups and letters after a virus searches the victim's computer hard drive for media content.
That offers a "pretrial settlement" fine payable by credit card, and warns of costly court cases and even jail sentences if the victim ignores the notice.
In fact it says this even if it does not find anything on the hard drive, so it is remarkablely like an RIAA enforcement notice.
