By Gregg Keizer
December 29, 2008

Amazon.com Inc. last week warned customers running Windows XP that a Samsung digital photo frame it sold through earlier this month might have come with malware on the driver installation CD. An Amazon.com customer posted the warning a week ago to the online retailer's user forum.

It its note to customers, Amazon.com noted that a Samsung advisory had been issued for the SPF-85H, an 8-in. digital photo frame that Amazon sold for approximately $150 starting in October. The Samsung SPF-85H is no longer available on Amazon.com. "We have recently learned that Samsung has issued an alert ... our records indicate that you have purchased one of the digital photo frames through the Amazon.com website and are therefore affected by this alert," said Amazon in the note.

Samsung released its advisory download PDF on Nov. 27, and listed five photo frame models as affected: SPF-75H, SPF-76H, SPF-85H, SPF-85P and SPF-105P. According to Samsung's alert, "a batch of Photo Frame Driver CDs contain [sic] a worm virus in the Frame Manager software. This is a risk of the customers [sic] host PCs being infected with this worm virus." Samsung did not specify how the malware got on the CD, or how it escaped its quality control checks.

Amazon's advisory identified the malware as "W32.Sality.AE," the name assigned by Symantec Corp. Other security vendors, such as McAfee Inc. and Trend Micro Inc., have pegged the malware with other names, including "W32/Sality" and "Troj_Agent.xoo," respectively. Symantec's write-up said W32.Sality.AE was a downloader, a malicious program that once installed, downloads even more malevolent attack code.