|
| |
|
Subject:
Battle of the worms begins |
August 17, 2005 |
Computer virus writers are at war,
attacking each other, according to a security firm.
HELSINKI (Reuters) - Computer worms that have brought down systems
around the world in recent days are starting to attack each other,
Finnish software security firm F-Secure said Wednesday.
"We seem to have a bot-war on our hands," said Mikko Hypponen,
chief research officer at F-Secure.
"There appear to be three different virus-writing gangs turning
out new worms at an alarming rate, as if they were competing to
build the biggest network of infected machines."
Hypponen said in a statement that varieties of three worms -- "Zotob,"
"Bozori" and "IRCbot" -- were still exploiting a gap in
Microsoft Corp.'s
(Research)
Windows 2000 operating system on computers that had not had the flaw
repaired and were not shielded by firewalls.
"The latest variants of Bozori even remove competing viruses like
Zotob from the infected machines," Hypponen said in a statement on the
company's Web site. (http://www.f-secure.com)
The worms were blamed for major system trouble at some media
outlets and companies in the United States on Tuesday, causing
personal computers to restart repeatedly and potentially making them
vulnerable to attack.
Microsoft and the top computer security companies,
Symantec Corp. (Research)
and
McAfee Inc. (Research),
said damage to systems on Tuesday had been limited and was unlikely to
cause widespread havoc like that which resulted from other malicious
software such as "SQL Slammer" and "MyDoom."
Windows 2000 attacked. For more,
click here.
For tips on protecting your computer,
click here. |
|
|
|
|
|
|
Subject: New Bagle E-mail Worm Spreads |
August 10, 2004 |
Antivirus updates available, but experts say this variant may
fool some software.
A new version of the Bagle e-mail worm has surfaced and is
spreading quickly among Internet users, antivirus and computer security
companies warn.
The new worm goes by a number of different names and is very similar to
earlier versions of the worm . But this latest incarnation also has new
features that allow it to trick antivirus software and content
filtering products, says Sam Curry, vice president of e-Trust Security
Management at Computer Associates International.
Since the start of the year, a flurry of Bagle variations have popped up.
Some experts believe a so-called "war" between rival virus-writers
is behind the ongoing proliferation of Internet worms.
CA and others have released updated virus definitions, or "signatures," that
spot the new variant. In addition, antivirus products that use heuristic
technology to spot viruses may be able to spot the new variant without an
updated virus signature, Curry says.
Bagle Arrived With Morning Bagel
Both CA and antivirus company McAfee rate the new version of Bagle a
"medium" threat, citing increasing number of samples submitted by users.
CA detected the new Bagle, which it dubbed Bagle.AG, at around 9 a.m.
Eastern time on Monday, when most workers are first having their morning
coffee and bagel (the edible variety). The new worm may have been "seeded"
through e-mail distribution akin to spam e-mail campaigns, says
Helsinki-based antivirus company F-Secure. F-Secure, like McAfee, has
labeled the new worm Bagle.AQ.
Submissions from CA customers accelerated on Monday afternoon, with
more than 35 enterprises and 300 consumers submitting samples of the worm
to CA.
Similar, But With a Twist
The new Bagle is nearly identical to earlier versions of Bagle. Like those
earlier versions, it contains its own Simple Mail Transfer Protocol (SMTP)
e-mail engine, gleans e-mail addresses from files stored on the hard drive
of computers it infects, and sends copies of itself out to those addresses
using forged (or "spoofed") sender addresses.
However, the new variant also has some new features that make it harder
to catch, Curry says.
Among other things, the new worm injects a file known as a dynamic link
library, or DLL, into Windows that allows the worm to disguise itself
as Microsofta??s Internet Explorer Web browser. That allows Bagle
to masquerade its actions as those of IE, fooling firewall software
that may be running on machines it infects and that would block
communications to other systems on the Internet from unauthorized
applications. As a result, this Bagle version is able to request and
download malicious files with impunity, Curry notes.
For companies that may use content-blocking products that inspect Web
traffic, the new Bagle variant also has a feature that alters the names
of files it requests in transit. For example, it can rename .EXE program
files as innocuous files such as JPEG images, which content-filtering
products typically allow. Once downloaded to the infected system, however,
the new Bagle version renames and runs the .EXE files, Curry explains.
CA is still analyzing Bagle, but Curry believes that the new worm version
is spreading, in part, by exploiting a vulnerability in a Windows
feature for viewing and opening .ZIP compressed file archives. That
vulnerability allows the worm to be installed if users simply view
the .ZIP-format e-mail attachment containing the worm file using the
Windows Explorer or the IE browser.
Source:
http://www.pcworld.com/news/article/0,aid,117307,00.asp
|
|
Email Viewing Tips: |
|
Virus Alert: New Beagle Variant |
Date: 3/8/2004 |
Please Note: Whenever you receive an attachment within an e-mail,
use caution and approach it as if it has
potential of being a virus -- even if you know the sender.
As a business rule, Interland & IDC never sends
executable file as
attachments through e-mails. Therefore, please do not open or run any
attachment or message that appears to be coming from Interland or IDC.
We recognize the importance of e-mail to your business, and we continue to
work diligently to protect you and your business from the effects of this
malicious activity.
Your message couldn't be sent - or
disguised
as returned mail - if you didn't send mail to that recipient
do not
open the attachment to read the details, it most likely contains a virus!!
One of the following lines:
-- Dear user of
,
-- Dear user of
gateway e-mail server,
-- Dear user of e-mail server "",
-- Hello user of
e-mail server,
-- Dear user of "" mailing system,
-- Dear user, the management of
mailing system wants to let you know that,
Followed by one of the following paragraphs:
-- Your e-mail account has been temporary disabled because of unauthorized
access.
-- Our main mailing server will be temporary unavailable for next
two days, to continue receiving mail in these days you have to configure
our free auto-forwarding service.
-- Your e-mail account will be disabled because of improper
using in next three days, if you are still wishing to use it, please,
resign your account information.
-- We warn you about some attacks on your e-mail account. Your
computer may contain viruses, in order to keep your computer and e-mail
account safe, please, follow the instructions.
-- Our antivirus software has detected a
large amount of viruses outgoing from your
e-mail account, you may use our free anti-virus tool
to clean up your computer software.
-- Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by a
proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.
Followed by one of the following lines:
-- For more information see the attached file.
-- Further details can be obtained from attached file.
-- Advanced details can be found in attached file.
-- For details see the attach.
-- For details see the attached file.
-- For further details see the attach.
-- Please, read the attach for further details.
-- Pay attention on attached file.
Followed by:
-- The
team <<<>>>http://www.
Followed by one of the following lines:
-- The Management,
-- Sincerely,
-- Best wishes,
-- Have a good day,
-- Cheers,
-- Kind regards,
The attachment to the e-mail message is in the form of a password
protected zip (compressed) file, which, due
to its format, can’t be scanned for viruses.
NOTE: You can usually tell an attached file's type by looking at the three
letters following the period within the file name.
File types that can potentially be harmful include .exe, .com, .vbs, .bat,
.pif, .zip and .scr.
|
|
