On The Insider: Jenna Jameson is Pregnant
BNET Business Network:
BNET
TechRepublic
ZDNet

By Dawn Kawamoto, News.com
Posted on ZDNet News: Oct 29, 2004 3:21:00 PM

A new version of the fast-spreading Bagle mass-mailing worm was discovered Friday, with its threat level quickly rising to a moderate level, according to security experts.

Bagle.BB, also known as W32/Bagle.bb@MM, was raised to a medium risk assessment by security company McAfee. The virus had triggered more than 100 reports to McAfee's antivirus and vulnerability emergency response team by early morning in Europe. Antivirus software makers have also identified two other variants of the Bagle virus that are successfully spreading.

Other security experts noted that there are specific challenges with the latest variant of Bagle.

CNET Reviews
Prevention and cure: Bagle.bb
This version appears as an e-mail message with a smiley face : )). It only affects Windows machines.
"This version tries to block the Netsky virus on users' machines, which seems like retaliation on Netsky," said Stefana Ribaudo, a security management product manager for Computer Associates International. The authors of the Bagle and Netsky variants have taken to taunting each other in the worms' software code.

Ribaudo added that the Bagle virus, which is also known as Bagel AX and W32.Beagle.AV, tries to disable antivirus software loaded on people's computers.

Increasingly, computer viruses are serving as a tool to surreptitiously use another person's computer to send out spam or collect personal financial information.

Security experts note that the profit that can be made from these activities is driving the rapid rise in virus and hacker attacks.

The most recent version of the Bagle virus is another in a long list of variants of the virus, which began infecting computers in January.

BitDefender Labs noted that the new Bagel variant creates copies of itself in varying lengths, in a move to make it harder to filter out of e-mails using antivirus software.

Bagle.BB harvests addresses from local files and then uses those addresses in the "from" field to send itself, according to McAfee.

As a result, the recipient of Bagle.BB receives a bogus e-mail with a spoofed sender address, which, for example, may appear to come from a legitimate friend, business associate or family member.

The subject header from the spoofed sender will contain such greetings as "Hello," "Thank you!" and "Thanks :)."

As with a number of viruses, it spreads when the recipient opens the e-mail attachment. The executable name of the attachment is listed as "price," "Price" or "Joke," according to McAfee.

Once the virus in the attachment has been released, it will copy itself onto the Windows system directory. It will also open TCP port 81, as a means for remote access to a user's computer.

  • Talkback
  • Most Recent of 65 Talkback(s)
Dont forget scripts and script-able apps
Other exec types:
VBS, CS, PL, PIF, App formats: MDB, MDE, XLS,etc. all of which can have autoexec scripts that execute at your authority.... (Read the rest)
Posted by: achavez382 Posted on: 03/03/05 You are currently: Logged In | Log out
Not to worry if... htotten   | 10/29/04
Not to worry if.... InetUser_z   | 10/29/04
All you need to protect you users.. FreeBSD   | 10/29/04
SAV Intelligent Update vs LiveUpdate MMcK_z   | 10/29/04
Not to worry if... DarthRidiculous   | 10/29/04
using a mac broadway al   | 10/29/04
gotcha on Live Update carnac   | 10/29/04
You strip all executable attachments... boomslang_z   | 10/29/04
What is the MIME type for executable? Yagotta B. Kidding   | 10/29/04
Hmm, why does it work so well then? boomslang_z   | 10/30/04
Dont forget scripts and script-able apps achavez382   | 03/03/05
1st Commandment Squawkbox   | 10/29/04
Why not? Yagotta B. Kidding   | 10/29/04
2nd Commandment itanalyst   | 10/29/04
Wrong again IT Scion   | 10/29/04
One Blocked Virus Does Not A Good OS Make itanalyst   | 10/29/04
Interesting gary.douglas@...   | 10/29/04
If more ppl were knowledgeable FilledOut   | 10/29/04
Under the hood tic swayback   | 10/29/04
Interesting? U Mean LAME. whogoesthere   | 10/29/04
Incredible? PA-ITGuy   | 10/29/04
Pot - Kettle (NOT) whogoesthere   | 10/29/04
Re: Pot - Kettle PA-ITGuy   | 10/30/04
Amen a40961_z   | 10/30/04
Get under the hood? Linux User 147560   | 10/29/04
Outlook blocking is not a solution for me voska   | 10/29/04
But DarthRidiculous   | 10/29/04
Nonsense Yagotta B. Kidding   | 10/29/04
3rd Commandement Chad_z   | 10/29/04
Symantec Support tygeverink@...   | 10/29/04
Suggestion for Symantec genya356@...   | 10/29/04
Trend Micro mojoguy   | 10/29/04
AV support thutchins   | 10/29/04
Are you using Enterprise Edition? The King's Servant   | 10/29/04
Symantec Support MRBOWTIE   | 10/29/04
Any suggestions? Laura Silvero   | 10/31/04
AVG Kamikaze_Ohka   | 11/01/04
Symantec Support earnescw   | 11/17/04
Got better with Computer Associates zackszoo   | 10/29/04
4th commandment CobraA1   | 10/29/04
5th Commandement Bio_nuclear   | 10/29/04
Well... Anton Philidor   | 10/29/04
Where have you been? DarthRidiculous   | 10/29/04
How about... AmusedAtItAll   | 10/29/04
You need to know how SMTP works voska   | 10/29/04
And this will help Yagotta B. Kidding   | 10/29/04
6th Commandment itanalyst   | 10/29/04
Remember lengua99   | 11/11/04
TruPrevent users were totally protected childol   | 10/29/04
Excellent product... The King's Servant   | 10/29/04
OR... childol   | 10/29/04
What are all these pesky creatures/features? michael-t   | 10/29/04
Well... John E Wahd   | 11/01/04
Meta-Commandment michael-t   | 10/29/04
Just another reason richdave   | 10/30/04
Can't Wait DickWelf   | 10/30/04
Dick, it is happening now! derekgore   | 11/01/04
Wow! No Linux and Mac replies? derekgore   | 11/01/04
When it happens once in a blue moon lengua99   | 11/11/04
Shouldn't it be SOP to.. GGS430   | 10/30/04
in addition GGS430   | 11/01/04
7th Commandment George Jay   | 11/01/04
8th Commandment flyingbuick   | 11/05/04
IS THE USER OR OS REALLY AT FAULT linbegone   | 11/07/04
Yeah, but lengua99   | 11/11/04

What do you think?