| Web Site Portfolio |
| Resource Center |
Innovative Design Concepts:
|
|
|
|
|
| Subject: Battle of the worms begins | ||
|
||
| Subject: New Bagle E-mail Worm Spreads | August 10, 2004 | |
|
Antivirus updates available, but experts say this variant may
fool some software. A new version of the Bagle e-mail worm has surfaced and is spreading quickly among Internet users, antivirus and computer security companies warn. The new worm goes by a number of different names and is very similar to earlier versions of the worm . But this latest incarnation also has new features that allow it to trick antivirus software and content filtering products, says Sam Curry, vice president of e-Trust Security Management at Computer Associates International. Since the start of the year, a flurry of Bagle variations have popped up. Some experts believe a so-called "war" between rival virus-writers is behind the ongoing proliferation of Internet worms. CA and others have released updated virus definitions, or "signatures," that spot the new variant. In addition, antivirus products that use heuristic technology to spot viruses may be able to spot the new variant without an updated virus signature, Curry says. Bagle Arrived With Morning Bagel Both CA and antivirus company McAfee rate the new version of Bagle a "medium" threat, citing increasing number of samples submitted by users. CA detected the new Bagle, which it dubbed Bagle.AG, at around 9 a.m. Eastern time on Monday, when most workers are first having their morning coffee and bagel (the edible variety). The new worm may have been "seeded" through e-mail distribution akin to spam e-mail campaigns, says Helsinki-based antivirus company F-Secure. F-Secure, like McAfee, has labeled the new worm Bagle.AQ. Submissions from CA customers accelerated on Monday afternoon, with more than 35 enterprises and 300 consumers submitting samples of the worm to CA. Similar, But With a Twist The new Bagle is nearly identical to earlier versions of Bagle. Like those earlier versions, it contains its own Simple Mail Transfer Protocol (SMTP) e-mail engine, gleans e-mail addresses from files stored on the hard drive of computers it infects, and sends copies of itself out to those addresses using forged (or "spoofed") sender addresses. However, the new variant also has some new features that make it harder to catch, Curry says. Among other things, the new worm injects a file known as a dynamic link library, or DLL, into Windows that allows the worm to disguise itself as Microsofta??s Internet Explorer Web browser. That allows Bagle to masquerade its actions as those of IE, fooling firewall software that may be running on machines it infects and that would block communications to other systems on the Internet from unauthorized applications. As a result, this Bagle version is able to request and download malicious files with impunity, Curry notes. For companies that may use content-blocking products that inspect Web traffic, the new Bagle variant also has a feature that alters the names of files it requests in transit. For example, it can rename .EXE program files as innocuous files such as JPEG images, which content-filtering products typically allow. Once downloaded to the infected system, however, the new Bagle version renames and runs the .EXE files, Curry explains. CA is still analyzing Bagle, but Curry believes that the new worm version is spreading, in part, by exploiting a vulnerability in a Windows feature for viewing and opening .ZIP compressed file archives. That vulnerability allows the worm to be installed if users simply view the .ZIP-format e-mail attachment containing the worm file using the Windows Explorer or the IE browser. Source:
http://www.pcworld.com/news/article/0,aid,117307,00.asp |
||
|
Email Viewing Tips: |
||
| Virus Alert: New Beagle Variant | Date: 3/8/2004 | |
|
Please Note: Whenever you receive an attachment within an e-mail,
use caution and approach it as if it has
potential of being a virus -- even if you know the sender.
As a business rule, Interland & IDC never sends
executable file as
attachments through e-mails. Therefore, please do not open or run any
attachment or message that appears to be coming from Interland or IDC.
We recognize the importance of e-mail to your business, and we continue to work diligently to protect you and your business from the effects of this malicious activity. Your message couldn't be sent - or
disguised
as returned mail - if you didn't send mail to that recipient
do not
open the attachment to read the details, it most likely contains a virus!!
-- Your e-mail account will be disabled because of improper
using in next three days, if you are still wishing to use it, please,
resign your account information.
-- We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. -- Our antivirus software has detected a large amount of viruses outgoing from your e-mail account, you may use our free anti-virus tool to clean up your computer software. -- Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions. Followed by one of the following lines: -- For more information see the attached file. -- Further details can be obtained from attached file. -- Advanced details can be found in attached file. -- For details see the attach. -- For details see the attached file. -- For further details see the attach. -- Please, read the attach for further details. -- Pay attention on attached file. Followed by: -- The Followed by one of the following lines: -- The Management, -- Sincerely, -- Best wishes, -- Have a good day, -- Cheers, -- Kind regards, The attachment to the e-mail message is in the form of a password protected zip (compressed) file, which, due to its format, can’t be scanned for viruses. NOTE: You can usually tell an attached file's type by looking at the three letters following the period within the file name. File types that can potentially be harmful include .exe, .com, .vbs, .bat, .pif, .zip and .scr. |
||
