Press Releases

Browse our press release archive

16 Feb 2006

Bagle-CO worm carries words of love in late Valentine

Experts at SophosLabs™, Sophos's global network of virus, spyware and spam analysis centers, have advised users not to panic over a new version of the Bagle worm which poses as a romantic valentine poem.

The W32/Bagle-CO worm spreads in emails with subject lines such as "Will You Be My Valentine?", "Love you with all my heart!", "See you tonight!", "Come Be With Me, my Love!", and "My dream is coming true!". The emails urge the recipient to "Click to attachment to load a movie" followed by one of three romantic poems. If the attached file is executed by the recipient the worm installs itself on the PC and looks for other computers to infect.

"People unlucky enough not to have received a Valentine's Card earlier this week, may be excited at the prospect of this late delivery, but they shouldn't lose their head and click without thinking," said Graham Cluley, senior technology consultant at Sophos. "By disguising their malware as a late Valentine email the virus author is aiming to infect the unwary. Everyone should exercise caution when they receive an unsolicited email like this."

Sophos experts note that the emails deliberately appear to show a broken link to a graphic at the top of the message, further encouraging users to click on the attachment.

"It's a cunning piece of social engineering for the hacker to make it appear as though a graphic is not being displayed properly. In the rush for romance, a user may not think twice before opening the attached malicious file," continued Cluley. "This isn't the first time a virus writer has felt moved to use poetry inside his malware. In the early 1990s the Maltese Amoeba virus, for example, invited victims 'to see a world in a grain of sand', a fragment of a poem by William Blake."

A typical message sent by the Bagle-CO worm

A typical message sent by the Bagle-CO worm.

Sophos has been protecting businesses against the W32/Bagle-CO worm since 18:14 GMT on 15 February 2006.

Companies are recommended to protect their email with a consolidated solution to thwart the virus, spyware and spam threats and secure their desktops and servers with automatically updated anti-virus protection.

The W32/Bagle-CO worm can choose one of three different poems to include in the emails it sends.

Poem one:

Love at the lips was touch
As sweet as I could bear;
And once that seemed too much;
I lived on air

That crossed me from sweet things,
The flow of - was it musk
From hidden grapevine springs
Down hill at dusk?

I had the swirl and ache
From sprays of honeysuckle
That when they're gathered shake
Dew on the knuckle.

I craved strong sweets, but those
Seemed strong when I was young;
The petal of the rose
It was that stung.

Now no joy but lacks salt
That is not dashed with pain
And weariness and fault;
I crave the stain

Of tears, the aftermark
Of almost too much love,
The sweet of bitter bark
And burning clove.

When stiff and sore and scarred
I take away my hand
From leaning on it hard
In grass and sand

The hurt is not enough:
I long for weight and strength
To feel the earth as rough
To all my length.

Poem two:

A stranger came to the door at eve,
And he spoke the bridegroom fair.
He bore a green-white stick in his hand,
And, for all burden, care.
He asked with the eyes more than the lips
For a shelter for the night,
And he turned and looked at the road afar
Without a window light.

The bridegroom came forth into the porch
With, "Let us look at the sky,
And question what of the night to be,
Stranger, you and I.
"The woodbine leaves littered the yard,
The woodbine berries were blue,
Autumn, yes, winter was in the wind;
"Stranger, I wish I knew."

Within, the bride in the dusk alone
Bent over the open fire,
Her face rose-red with the glowing coal
And the thought of the heart's desire.
The bridegroom looked at the weary road,
Yet saw but her within,
And wished her heart in a case of gold
And pinned with a silver pin.

The bridegroom thought it little to give
A dole of bread, a purse,
A heartfelt prayer for the poor of God,
Or for the rich a curse;
But whether or not a man was asked
To mar the love of two
by harboring woe in the bridal house,
The bridegroom wished he knew.

Poem three:

I woke up in a white room
with white lace curtains.
Snow covered landscape;
I'm in Memphis for certain

Yesterday, it took over three hours
just to travel the last twenty miles.
But nothing is like my wife's family
always being greeted with smiles

I was hoping for a White Christmas.
You'd be surprise how simple I am.
Be careful what you wish for
God may be listening to your plan.

Most of the nation is covered
with that dangerous and beautiful thing
I am grateful for arriving safely
for my wife's happiness is everything.

She wanted to see her family,
her father, uncles and aunts.
I ve kept her in Southwest Texas too long;
this trip I most willingly grant.

So, here we are now
in a snowy southern wonderland.
Waiting for Christmas dinner to come;
a present only my wife can understand

About Sophos

More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing complete security solutions that are simple to deploy, manage, and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, mobile and network security solutions backed by SophosLabs - a global network of threat intelligence centers.

Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.