W32/Bagle-CM is a worm and backdoor Trojan for the Windows platform.
W32/Bagle-CM spreads via file sharing on P2P networks and via email.
W32/Bagle-CM runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
W32/Bagle-CM includes functionality to access the internet and communicate with a remote server via HTTP.
W32/Bagle-CM will harvest email addresses found on the infected computer and send itself to these addresses with the following email characteristics:
Subject (one of the following):
FREE OLYMPIC TICKETS LOTTERY!
2006 Winter Games in Torino
2006 Torino Winter Games FREE Tickets
Message text (one of the following):
'Attention: you recieved free ticket invitation with attachment!
Coast to Coast Tickets provides the most comprehensive inventory of Opening Ceremony tickets available on the secondary market. If the Opening Ceremony tickets you are looking for are not available, please check back as our inventory is constantly updated. Orders for Opening Ceremony tickets that are no longer available will be cancelled or substituted at the customer's discretion. All Opening Ceremony tickets are shipped via Federal Express.
If you would like to attend a Opening Ceremony event to see athletes live, or to see a team schedule and information, Coast to Coast Tickets is your source. All it takes is a phone call or a few clicks of the mouse to buy Opening Ceremony tickets. We offer a wide selection of Winter Games tickets for all teams, and we are happy to provide information about schedules at any time. '
'Our company (TicketWorld) is the world's largest supplier of tickets to all major international events including the 2006 Winter Games and 2006 Torino Tickets. We sell tickets to every sporting event in Torino including the preliminary competitions as well as Olympic Finals tickets. You can order Winter Games tickets for all categories for every match. All Winter Games tickets are guaranteed 200%.
All ticket prices are in US Currency ($).
OPEN ATTACHMENT ARCHIVE TO GET INFORMATION HOW TO OBTAIN A FREE TOCKET.
Please call our United States office at +1.512.472.5797 or from the United Kingdom 0800.781.0819 if you have questions.'
'The Torino Winter games will be the most celebrated Olympics of our era. If you are looking to witness this historic event for yourself, look no further. SuperTicketing Premium Seating is your source for Olympics tickets. We have access to tickets for nearly every Olympic event from Opening to Closing Ceremonies, Curling to Figure Skating.
FREE TICKECKS AVAILABLE NOW ON LOTTERY BASIS. CHECK ATTACHED FILE.
DISCLAIMER
TickCo Premium Seating buys and resells tickets on the secondary market at above face value. Our prices can be substantially higher than the original ticket price, as they reflect the cost of obtaining premium seating. Any trademarked terms that appear on this page are used for descriptive purposes only.'
Attachment name (one of the following):
Generated_bill.exe
Order_details.exe
Service_receipt.exe
The email may also contain another attachment:
Description.txt
This file is not malicious.
W32/Bagle-CM is a worm and backdoor Trojan for the Windows platform.
W32/Bagle-CM spreads via file sharing on P2P networks and via email.
W32/Bagle-CM runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
W32/Bagle-CM includes functionality to access the internet and communicate with a remote server via HTTP.
W32/Bagle-CM will harvest email addresses found on the infected computer and send itself to these addresses with the following email characteristics:
Subject (one of the following):
FREE OLYMPIC TICKETS LOTTERY!
2006 Winter Games in Torino
2006 Torino Winter Games FREE Tickets
Message text (one of the following):
'Attention: you recieved free ticket invitation with attachment!
Coast to Coast Tickets provides the most comprehensive inventory of Opening Ceremony tickets available on the secondary market. If the Opening Ceremony tickets you are looking for are not available, please check back as our inventory is constantly updated. Orders for Opening Ceremony tickets that are no longer available will be cancelled or substituted at the customer's discretion. All Opening Ceremony tickets are shipped via Federal Express.
If you would like to attend a Opening Ceremony event to see athletes live, or to see a team schedule and information, Coast to Coast Tickets is your source. All it takes is a phone call or a few clicks of the mouse to buy Opening Ceremony tickets. We offer a wide selection of Winter Games tickets for all teams, and we are happy to provide information about schedules at any time. '
'Our company (TicketWorld) is the world's largest supplier of tickets to all major international events including the 2006 Winter Games and 2006 Torino Tickets. We sell tickets to every sporting event in Torino including the preliminary competitions as well as Olympic Finals tickets. You can order Winter Games tickets for all categories for every match. All Winter Games tickets are guaranteed 200%.
All ticket prices are in US Currency ($).
OPEN ATTACHMENT ARCHIVE TO GET INFORMATION HOW TO OBTAIN A FREE TOCKET.
Please call our United States office at +1.512.472.5797 or from the United Kingdom 0800.781.0819 if you have questions.'
'The Torino Winter games will be the most celebrated Olympics of our era. If you are looking to witness this historic event for yourself, look no further. SuperTicketing Premium Seating is your source for Olympics tickets. We have access to tickets for nearly every Olympic event from Opening to Closing Ceremonies, Curling to Figure Skating.
FREE TICKECKS AVAILABLE NOW ON LOTTERY BASIS. CHECK ATTACHED FILE.
DISCLAIMER
TickCo Premium Seating buys and resells tickets on the secondary market at above face value. Our prices can be substantially higher than the original ticket price, as they reflect the cost of obtaining premium seating. Any trademarked terms that appear on this page are used for descriptive purposes only.'
Attachment name (one of the following):
Generated_bill.exe
Order_details.exe
Service_receipt.exe
The email may also contain another attachment:
Description.txt
This file is not malicious.
When first run W32/Bagle-CM copies itself to <System>\lsamgr.exe, <Windows>\Wimanager.exe, <System>\lsamgr.exeopen and <System>\lsamgr.exeopenopen, as well as to any folder whose name contains the word 'shar' using the following filenames:
Adobe Photoshop 9 full.exe
Ahead Nero 10.exe
Britney Spears sex photos.exe
IE beta 7.exe
Porno Screensaver.scr
Serials 2005 database.exe
Serials.txt.exe
Windown Vista Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe
anna benson sex video.exe
barrett jackson nude photos, movies, porn video.exe
jenna elfman sex anal deepthroat
kate beckinsale nude pictures.exe
miss america Porno, sex, oral, anal cool, awesome!!.exe
on.co.uk
paris hilton Porno pics arhive, xxx.exe
user@host.domain
The following registry entry is created to run lsamgr.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
LsaManager
<System>\lsamgr.exe