It's Bagle Day, Again Three New Strains Are Rapidly Spreading Ryan Naraine
Anti-virus firms have raised the alarm after spotting three new strains of the Bagle virus rapidly spreading through e-mail inboxes.
Almost a year after the virus was first detected, research firm F-Secure increased the threat level on the worm, which arrives with three .EXE files attached — Price.exe,
Joke.exe and RunMe.exe.
"The interesting thing about the latest variants is that they modify themselves before spreading: they search for applications on a hard disk and "borrow" their icons," F-Secure said in a note posted online.
The company said the "borrowed" icons are then attached to Bagle's files together with some garbage data (used as a decoy) before being mailed out. "You might see Bagle variants with quite interesting icons," F-Secure said.
One of the new strains, Bagle.AT, is a mass-mailing worm with peer-to-peer spreading capabilities. In e-mail environments, Bagle.AT spreads using different subjects, e-mail bodies, and attachments.
F-Secure said the worm has a password-protected backdoor that listens on port 81. "The worm author who knows the password can connect to the computer and execute arbitrary programs. Infected computers are reported to the worm's author by accessing several predefined URLs," the company warned.
Bagle.AT is also capable of spreading to shared folders of peer-to-peer clients.
Anti-virus specialist Sophos also released an advisory with a warning the new variant is capable of significantly impairing e-mail systems if it reaches a critical mass.
"Companies without an automatically updating virus protection in place are at risk for a communications failure and should ensure that their anti-virus is up-to-date immediately," Sophos said.
Advisories have also been issued by Symantec and McAfee.
In March this year, a batch of Bagle variants were released in the wild and effectively disrupted corporate network traffic for several days.
The source code for the virus was also released on the Internet.
