A worm which can spread exploiting the names of celebrities such as actress Halle Berry, popstar Kylie Minogue and chanteuse Celine Dion has created confusion for some users in recent days.
Sophos has recorded an increased number of users searching its website for information about the "Lorraine" or "W32/Lorraine" virus - however, there is no virus known by this name.
The reason for the confusion? The W32/Mapson-A worm spreads via email and P2P internet file-sharing systems claiming variously to contain pictures of nude female celebrities, trailers of "The Matrix", or information about the reality TV show "Big Brother".
Although graphic images themselves cannot contain viruses, the dangerous files downloaded from the internet file-sharing systems have double extensions, hiding their true identity as executable files. For instance, Nude Pic Britney Spears.gif .exe
In July the worm is programmed to display a message box describing itself as the "Lorraine Worm". On the fourth of any month it goes further and displays the message:
W32/Lorraine - Gedzac Labs 2003
//***********[GEDZAC LABS 2003]***********//
W32/Lorraine by Falckon/GEDZAC
wOrm hecho en Delphi 6 Dedicado a mi Lorena
Hecho en MéXiKO
Because of this some affected computer users have mistakenly thought the virus's name is W32/Lorraine.
"The message is simple: try and curb your desires. Whether you're desperate to hear what's going on in the Big Brother house, peek at Shakira in her bikini or view the latest blockbuster trailer it's probably best if you resist the temptation," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "Practise safe computing to help keep your systems virus-free and ensure your anti-virus is always up-to-date."
The worm has caused few problems for Sophos customers, who have had anti-virus protection available against W32/Mapson-A available since 9 June 2003.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.