Do not open any suspicious e-mails and/or attachments - Delete them from your Inbox and from your Deleted Items tHE FOLLOWING NEW BAGLE VARIANTS HAVE BEEN REPORTED AS SPREADING THROUGHOUT THE NETWORK W32/Bagle-Q and W32/Bagle-R, use a different method of infection, spreading without an email attachment, in an attempt to bypass anti-virus protection. W32/Bagle-N and W32/Bagle-O, are using a sneaky trick using graphic passwords in attempt to waltz past anti-virus protection at the email gateway. The worms can arrive in an email in the form of an attached password-protected archive file (Zip or RAR). Earlier versions of the Bagle worm sent themselves as password-protected Zips, but contained the password in the text of the email so the user could open the attached file. Because some anti-virus products were 'plucking' the password from the text of the email and using it to decrypt the attached file, the worms' author is now embedding the password as a graphic embedded inside the message instead. Win32.Bagle.T, generates HTML e-mail messages without attachments. The HTML attempts to download and execute the worm from another machine by exploiting an object tag vulnerability in Internet Explorer. The "from" address is spoofed. It is chosen from e-mail addresses harvested from the infected system. The subject is chosen from the following (Please delete) : Re: Msg reply Re: Hello Re: Yahoo! Re: Thank you! Re: Thanks :) RE: Text message Re: Document Incoming message Re: Incoming Message Re: Incoming Fax Hidden message Fax Message Received Protected message RE: Protected message Forum notify Request response Site changes Re: Hi Encrypted document The message body appears empty, but actually tries to load a .php file from another machine using HTTP on TCP port 81. It attempts to exploit the "object tag" vulnerability. ########################################################################## # Send submissions for Goanet to [EMAIL PROTECTED] # # PLEASE remember to stay on-topic (related to Goa), and avoid top-posts # # More details on Goanet at http://joingoanet.shorturl.com/ # # Please keep your discussion/tone polite, to reflect respect to others # ##########################################################################
