Bagle variant outstrips Google-bashing worm
A new variant of the Bagle email worm is spreading rapidly across the internet today. Email filtering firm BlackSpider Technologies reports that it was blocking 2000 copies of Bagle-AT an hour since its first appearance earlier this morning.
Bagle-AT is one of three new variants of the long-running email worm series released over the last 24 hours but the only variant to cause a significant problem. Emails infected with Bagle-AT come with one of several executable attachments (COM, EXE, SCR) and attachment names such as Price or Joke. Typical subject lines of infected emails include 'Re: Hello' or 'Re: Thank you!'.
Like previous variants, Bagle-AT is also capable of copying itself into shared folders of infected machines, thereby allowing it to spread across file-sharing networks. Also in common with its siblings, Bagle-AT contains a backdoor that enables virus writers or their associates to control infected machines. The worm also tries to disable a range of security applications, along with any instances of the NetSky worm it finds on infected machines. Anti-virus vendors rate Bagle-AT as a medium to high risk threat.
