On TV.com: SPONGEBOB'S Gettin' Hitched!
BNET Business Network:
BNET
TechRepublic
ZDNet

By Dawn Kawamoto
Posted on ZDNet News: Oct 29, 2004 3:21:00 PM

A new version of the fast-spreading Bagle mass-mailing worm was discovered Friday, with its threat level quickly rising to a moderate level, according to security experts.

Bagle.BB, also known as W32/Bagle.bb@MM, was raised to a medium risk assessment by security company McAfee. The virus had triggered more than 100 reports to McAfee's antivirus and vulnerability emergency response team by early morning in Europe. Antivirus software makers have also identified two other variants of the Bagle virus that are successfully spreading.

Other security experts noted that there are specific challenges with the latest variant of Bagle.

CNET Reviews
Prevention and cure: Bagle.bb
This version appears as an e-mail message with a smiley face : )). It only affects Windows machines.
"This version tries to block the Netsky virus on users' machines, which seems like retaliation on Netsky," said Stefana Ribaudo, a security management product manager for Computer Associates International. The authors of the Bagle and Netsky variants have taken to taunting each other in the worms' software code.

Ribaudo added that the Bagle virus, which is also known as Bagel AX and W32.Beagle.AV, tries to disable antivirus software loaded on people's computers.

Increasingly, computer viruses are serving as a tool to surreptitiously use another person's computer to send out spam or collect personal financial information.

Security experts note that the profit that can be made from these activities is driving the rapid rise in virus and hacker attacks.

The most recent version of the Bagle virus is another in a long list of variants of the virus, which began infecting computers in January.

BitDefender Labs noted that the new Bagel variant creates copies of itself in varying lengths, in a move to make it harder to filter out of e-mails using antivirus software.

Bagle.BB harvests addresses from local files and then uses those addresses in the "from" field to send itself, according to McAfee.

As a result, the recipient of Bagle.BB receives a bogus e-mail with a spoofed sender address, which, for example, may appear to come from a legitimate friend, business associate or family member.

The subject header from the spoofed sender will contain such greetings as "Hello," "Thank you!" and "Thanks :)."

As with a number of viruses, it spreads when the recipient opens the e-mail attachment. The executable name of the attachment is listed as "price," "Price" or "Joke," according to McAfee.

Once the virus in the attachment has been released, it will copy itself onto the Windows system directory. It will also open TCP port 81, as a means for remote access to a user's computer.

SponsoredWhite Papers, Webcasts, and Downloads

  • Talkback
  • Most Recent of 65 Talkback(s)
Dont forget scripts and script-able apps
Other exec types:
VBS, CS, PL, PIF, App formats: MDB, MDE, XLS,etc. all of which can have autoexec scripts that execute at your authority.... (Read the rest)
Posted by: achavez382 Posted on: 03/03/05 You are currently: a Guest | | Terms of Use
Not to worry if...  htotten | 10/29/04
Not to worry if....  InetUser_z | 10/29/04
All you need to protect you users..  FreeBSD | 10/29/04
SAV Intelligent Update vs LiveUpdate  MMcK_z | 10/29/04
Not to worry if...  DarthRidiculous | 10/29/04
using a mac  broadway al | 10/29/04
gotcha on Live Update  carnac | 10/29/04
You strip all executable attachments...  boomslang_z | 10/29/04
What is the MIME type for executable?  Yagotta B. Kidding | 10/29/04
Hmm, why does it work so well then?  boomslang_z | 10/30/04
Dont forget scripts and script-able apps  achavez382 | 03/03/05
1st Commandment  Squawkbox | 10/29/04
Why not?  Yagotta B. Kidding | 10/29/04
2nd Commandment  itanalyst | 10/29/04
Wrong again  IT Scion | 10/29/04
One Blocked Virus Does Not A Good OS Make  itanalyst | 10/29/04
Interesting  gary.douglas@... | 10/29/04
If more ppl were knowledgeable  FilledOut | 10/29/04
Under the hood  tic swayback | 10/29/04
Interesting? U Mean LAME.  whogoesthere | 10/29/04
Incredible?  PA-ITGuy | 10/29/04
Pot - Kettle (NOT)  whogoesthere | 10/29/04
Re: Pot - Kettle  PA-ITGuy | 10/30/04
Amen  a40961_z | 10/30/04
Get under the hood?  Linux User 147560 | 10/29/04
Outlook blocking is not a solution for me  voska | 10/29/04
But  DarthRidiculous | 10/29/04
Nonsense  Yagotta B. Kidding | 10/29/04
3rd Commandement  Chad_z | 10/29/04
Symantec Support  tygeverink@... | 10/29/04
Suggestion for Symantec  genya356@... | 10/29/04
Trend Micro  mojoguy | 10/29/04
AV support  thutchins | 10/29/04
Are you using Enterprise Edition?  The King's Servant | 10/29/04
Symantec Support  MRBOWTIE | 10/29/04
Any suggestions?  Laura Silvero | 10/31/04
AVG  Kamikaze_Ohka | 11/01/04
Symantec Support  earnescw | 11/17/04
Got better with Computer Associates  zackszoo | 10/29/04
4th commandment  CobraA1 | 10/29/04
5th Commandement  Bio_nuclear | 10/29/04
Well...  Anton Philidor | 10/29/04
Where have you been?  DarthRidiculous | 10/29/04
How about...  AmusedAtItAll | 10/29/04
You need to know how SMTP works  voska | 10/29/04
And this will help  Yagotta B. Kidding | 10/29/04
6th Commandment  itanalyst | 10/29/04
Remember  lengua99 | 11/11/04
TruPrevent users were totally protected  childol | 10/29/04
Excellent product...  The King's Servant | 10/29/04
OR...  childol | 10/29/04
What are all these pesky creatures/features?  michael-t | 10/29/04
Well...  James T. Kirk | 11/01/04
Meta-Commandment  michael-t | 10/29/04
Just another reason  richdave | 10/30/04
Can't Wait  DickWelf | 10/30/04
Dick, it is happening now!  derekgore | 11/01/04
Wow! No Linux and Mac replies?  derekgore | 11/01/04
When it happens once in a blue moon  lengua99 | 11/11/04
Shouldn't it be SOP to..  GGS430 | 10/30/04
in addition  GGS430 | 11/01/04
7th Commandment  George Jay | 11/01/04
8th Commandment  flyingbuick | 11/05/04
IS THE USER OR OS REALLY AT FAULT  linbegone | 11/07/04
Yeah, but  lengua99 | 11/11/04

What do you think?

advertisement
advertisement

White Papers, Webcasts, and Downloads

SmartPlanet

Click Here