Bagle Virus hits version 30 and goes wild

Now that it’s in its 30th variant, the viruses writers are releasing it for anybody to have a go.

7 July 2004 1:05 GMT / By Kenneth Henry

Illustrating why McAfee have decided to concentrate on internet security products, writers of the Bagle virus have decided, now that it's in its 30th variant, to release it for anybody to have a go.

Bagle-AD is a mass-mailing worm ZIPped into a single compressed file measuring around 65K, containing a file ending in .COM, .EXE or .SCR and uses its own SMTP engine to carry on mailing itself around. Also travelling in this efficient piece of malware is added code, which targets TCP Port 1234. Once that port's breeched, the PC can then be used by the hacker to commit a Distributed Denial Of Service (DDoS) attack or just spoof that PC's email information to spam email addresses.

Part of that spam may also include the virus's own source code, in case amateur coders wanting to make their first variant feel like spawning even more versions and trying to knock Klez-H and Sobig off the top of the virus charts.

Mac and Linux users can relax- It's Windows-centric once more. If your antivirus software hasn't auto updated, visit your own sites and update your software firewalls for good measure. We expect the usual spike in antivirus software sales in the charts from people who thought they wouldn't get hit, of course. McAfee's Stinger tool has been updated to take the worm into account.

click on the link for full information or check our Viruses and Threats Sticky in the software section of the forums:

http://uk.mcafee.com/virusInfo/default.asp?id=description&virus_k=126562