Bagle variant 10

By on March 3, 2004, 6:43 PM
The tenth variant of the virus Bagle has now been released. This one is a bit smarter than the others in three ways. It lists it's sender address as your domain, so for Techspot I for example got an e-mail from support@techspot.com (which is a nonexistant address btw)

The content of the e-mail is changed to reflect this, so it reads as it comes from the Techspot division bla bla....

The smartest thing is that in the e-mail the password is given for the attached compressed encrypted file, what this means is that any e-mail gateways will fail to find the virus since it is encrypted, thus bypassing any security measures and allowing the virus to end up at the local workstations inside your networks. Take big note of this admins!

[URL=http://www.f-secure.com/v-descs/bagle_j.shtml]Here is[/URL] a page on F-Secure with further details on the virus.




User Comments: 4

Got something to say? Post a comment
Mictlantecuhtli said:
Heh heh, once again it relies on people who not only click on attachments but in this case even decrypt the file :stickout:
---agissi--- said:
I'd hope most people who do open attachments from spam are smart enough only to do it once....
Masque said:
I see at least one a day in my inbox......damned annoying if you ask me. But not as much so as if I'd open it. ;)
SNGX1275 said:
My university got hit pretty good with this one, I got about 10 of them one night, had about 5 the next morning, and then got another one today. It was even more clever it said this [quote]Dear user, the management of UMR.EDU mailing system wants to let you know that,Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions.For more information see the attached file.For security purposes the attached file is password protected. Password is "02327".Best wishes, The UMR.EDU team [url]http://www.uMR.EDU[/url][/quote]But the UMR servers are taking care of this now, there still is an attachment, but its not the zip anymore, its just a 224B text (which is what you get when the virus has been removed by umr servers).
Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.