New Bagle, Netsky Worms on the Loose

Two new mass-mailing worms hit corporate networks Wednesday, continuing what has been a miserable spring for IT managers who have had to deal with an unrelenting rash of malware.

The two newest entrants are Bagle.AA and Netsky.AB, both of which have been rated as medium risks by antivirus vendors. There is little new in either of the viruses and they both borrow heavily from their forebears.

The new variant of Bagle uses an increasingly popular tactic among virus writers: attempting to terminate various security applications, including antivirus software and personal firewalls. The rest of its behavior is fairly typical, as the virus arrives via e-mail with a random subject line and spoofed sending address. Subject lines include “Re: Msg reply,” “Re: Yahoo,” and Re: Document.” The text of the e-mail is random and meaningless, as well.

The actual virus-infected attachment has any one of a number of file extensions, including .vbs, .hta, .exe and .scr. Once executed, the virus harvests e-mail addresses from the infected machine and begins mailing itself out. Bagle.AA also opens TCP Port 2535 and tries to send a message to the virus author notifying him that the machine is infected.

/zimages/4/28571.gifA recent version of the Bagle worm can infect systems without users launching an attachment.Click hereto read more.

Netsky.AB is even less clever than Bagle.AA. It simply spreads via e-mail messages with subject lines such as “Correction,” “Hurts,” “Privacy” and “Password.” The body of the message is nonsensical; a portion of the text includes:

How can I help you?
Still?
Ive your password

/zimages/4/28571.gifFor insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.

The infected attachment on Netsky.AB has a .pif extension, according to an analysis by Network Associates Inc., based in Santa Clara, Calif.

Both of the new worms appeared on Wednesday and antivirus vendors say theyve been seeing numerous copies of both on the Internet.

/zimages/4/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis. Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:/zimages/4/19420.gifhttp://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif