No need to panic over Winter Olympics Bagle worm

February 14, 2006 Sophos Press Release

Experts at SophosLabs™, Sophos's global network of virus, spyware and spam analysis centers, have advised users not to panic over a new version of the Bagle worm which poses as a message offering free tickets to the Winter Olympics in Turin.

The W32/Bagle-CM spyware worm spreads attached to emails using subject lines such as:

FREE OLYMPIC TICKETS LOTTERY!
2006 Winter Games in Torino
2006 Torino Winter Games FREE Tickets
with attached file names including:
Generated_bill.exe
Order_details.exe
Service_receipt.exe

The body of the email claims to come from a company selling tickets for the games in Turin, Italy, including Olympic final events. But if the attached file is run, the worm can steal information from the computer and allow hackers to gain remote access.

"This latest incarnation of the Bagle worm is hiding behind the flag of the Winter Olympics in an attempt to infect the unwary. But sensible precautions and a spoonful of common sense should ensure that no-one needs to have their computer struck down," said Graham Cluley, senior technology consultant for Sophos. "Companies are best protected by automating their anti-virus protection and putting a policy in place at their email gateway to block unsolicited executable code from the outside world."

Despite its sporting camouflage, the Bagle-CM worm is not currently spreading in large numbers. Sophos has been protecting businesses against the W32/Bagle-CM worm since 01:33 GMT on 14 February 2006.

The Bagle-CM worm also attempts to spread via P2P file-sharing systems as nude pictures of actress Kate Beckinsale, or erotic content related to hotel chain heiress Paris Hilton and pop starlet Britney Spears.

Companies are recommended to protect their email with a consolidated solution to thwart the virus, spyware and spam threats and secure their desktops and servers with automatically updated anti-virus protection.