October 29 -- Nine months since the W32/Bagle mass-mailing virus first appeared on the Internet, US-CERT continues to see new variants appearing and many variants (new and old) continuing to spread. Many variants of W32/Beagle are known to open a backdoor on an infected system, which can lead to further exploitation by remote attackers.
The most recent variant is W32/Bagle.AV (discovered on October 29th). This variant arrives as an email message with the following characteristics:
* Spoofed From address
* A Subject line containing one of the following:
o Re:
o Re: Hello
o Re: Hi
o Re: Thank you!
o Re: Thanks :)
* Body text containing one of the following:
o :)
o :))
* Attachment containing a filename of Price, price, or joke with a .COM,.CPL,.EXE, or .SCR file extension
US-CERT strongly encourages users to install and maintain anti-virus software and exercise caution when handling attachments. Anti-virus software may not be able to scan password protected archive files so users must use discretion when opening archive files and should scan files once extracted from an archive.
You may also wish to visit the US-CERT's computer virus resources page.
[ Comment, Edit or Article Submission ]
