eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Almost a year after the first Bagle worm started squirming through e-mail in-boxes, anti-virus vendors are reporting a new wave of attacks with new propagation techniques.
Three new variants were detected over the past 24 hours, and because of the high rate of distribution, anti-virus firms have increased the threat level and have rushed out signature updates.
One new mutant, Bagle.AY, is polymorphic and uses peer-to-peer spreading capabilities to multiply. It contains a backdoor that listens on TCP port 81 and is programmed to cease its activity on April 25, 2006, according to an alert from Finnish research firm F-Secure.
Anti-virus vendors McAfee Inc., Trend Micro Inc., Panda Software and Symantec Inc. all have raised their alert ratings and have issued warnings because of the worms rapid rate of propagation.
“Everyone should be cautious of unsolicited e-mail attachments, and be wary of what they download from Internet file-sharing networks,” said Graham Cluley, senior technology consultant at Sophos, a Lynnfield, Mass.-based security outfit.
Bagle.AY arrives in e-mail as a packed executable and is also capable of spreading with a prepended Windows CPL (control panel applet) stub. When spreading as a CPL file, the worm prepends a small binary dropper to its executable file. If that file is activated, the worm copies itself as cjector.exe file to the Windows folder and then drops the file into the Windows System folder.
The latest spawn spreads itself in e-mails with randomly chosen subject lines, mail text bodies and attachment names. The worm can attach itself to e-mails as an executable file with COM, EXE, SCR and CPL extensions.
Like its predecessors, the worms backdoor code is password-protected, allowing the worms author access to connect to the infected computer to execute arbitrary programs. Infected computers are reported to the worms author by accessing several predefined URLs.
Symantec also reported the detection of W32.Beagle.AZ and warned that distribution remained high throughout Friday.
The Bagle family of worms was among the top 10 threats for 2004.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.