Troj/ Bagle D1-L Trojan horse.

SophosLabs have detected many samples of a new Trojan horse being sent via email. The Troj/BagleD1-L Trojan horse appears to have been deliberately spammed out to email addresses around the world- Most of the email samples seen so far include a ZIP attachment which, when opened, includes a program file named 'doc_0I.exe' or "prs_03.exe', or some other innocuous sounding name.

If the program inside the ZIP file is opened, the Trojan horse tries to connect to one of a number of websites in order to download further malicious code. At the time of writing, none of these websites appeared to contain anything malicious.

Additionally, Troj/BagleD1-L tries to stop various security applications such as anti-virus and firewall software, to rename files belonging to security applications (so they can no longer load), and to block access to a range of security-related websites by changing the Windows HOSTS file.

Despite the wide distribution of this malicious program, Sophos has received very few reports of active infections. Also, because this program is a Trojan, and not a virus, it cannot spread further of its own accord.

Nevertheless, Sophos is advising customers to check that their anti-virus is up-to-date.

Comment:

This Trojan horse is aiming to take advantage of many people's reflex reaction when they receive an executable file via email: rather than not touching it with a bargepole, they often can't resist double-clicking on it, even though they have no idea if it's safe or not. It's time more companies woke up to the benefits of stopping executable code from entering their organisation via email. Users who want to install software on their computer should be receiving it from their IT department, not from friends at other companies or potentially dangerous spam mailings.

www.sophos.com