|
-
May 31st, 2005, 08:49 PM
#1
 Blank virus blanks email - New Bagle
It's happened yet again. A new version of the Bagle Downloader is spreading like wildfire via email, according to email filtering firm MessageLabs. MessageLabs has intercepted almost 70,000 copies since the arrival of the virus at lunchtime on Tuesday. The virus appears to have originated from a Yahoo! group.
The as-yet-unnamed Bagle downloader variant drops a Trojan that attempts to download updated malware from a long list of locations. Windows users who activate the file attached in the email invoke the virus, which harvests email addresses it finds on the computer's hard drive. The virus then forwards itself onto the list of email addresses it has discovered in infected computer.
The virus typically spreads in email messages with empty subject lines and body texts
http://www.theregister.co.uk/2005/05...le_downloader/
Hmm. I got an e-mail with no subject, to body text and just an attachment. Hmm what to do, what to do.  I know it happens all the time but it amazes me people still do this.
It's like Wile E. Coyote sticking his head in the cannon to see why it didn't go off when the Road Runner went by. KABOOM!!
\"You got a mouth like an outboard motor..all the time putt putt putt\" - Foghorn Leghorn
-
May 31st, 2005, 08:53 PM
#2
Folks over at SANS had something too (www.incidents.org)
New Bagel Virus(es?)
We have received a few reports that readers are receiving what appears to be a new version of the Bagle virus in email this morning. The attachments (so far) appear to be named as a single digit number zip file (eg: "5.zip" or "7.zip") as a string (eg: "Be_not_jealous.zip") with a payload of "16_05_2005.exe" or "19_04_2005.exe". The .zip file is approximately 18k and is 36352 when extracted. Upon execution, this file will be copied to C:\WINDOWS\System32\winshost.exe and will then drop another 11k file into C:\WINDOWS\System32\wiwshost.exe
The registry key HKLM/Software/Microsoft/Windows/Current Version/Run is then updated to execute this winshost.exe file at boot.
There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.
(Merovingian - Matrix Reloaded)
-
May 31st, 2005, 08:55 PM
#3
Oh come on...click on it..go ahead click on it...
Its calling you...come on click on it
I cant wait to hear the excuses for this one 
MLF
How people treat you is their karma- how you react is yours-Wayne Dyer
-
May 31st, 2005, 09:51 PM
#4
Neglected
intercepted almost 70,000 copies
I feel quite neglected, I have only had 132 copies hit my gateway. 
Cheers:
-
May 31st, 2005, 11:24 PM
#5
Hey Hey,
I got a copy through to my inbox today... It's the first time that AVG hasn't stripped one on me... So if anyone wants a copy of it.. I've got it sitting here.
Peace,
HT
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|
Reply With Quote
