Four new Bagle worms added to Internet soup

Robert Lemos | March 19, 2004 1:00 AM PST

Summary

Virus writers produce four more versions of the Bagle worm: Q, R, S and T. The worms exploit an ActiveX vulnerability for those that haven't updated Windows.

Topics

The Bagle computer virus has almost finished off the alphabet.

Virus writers' penchant for modifying the source code for the programhas resulted in four new variants--Bagle.Q, Bagle.R, Bagle.S andBagle.T--in the past two days, antivirus firms said on Thursday.


Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.


The viruses attempt to use an ActiveXvulnerability, discovered in August, to automatically uploadand run a program on the victim's computer, without needing the user torun a file. The viruses pose a threat to Windows users who havenot updated their operating system since the patch came out in August.

"It is definitely a new thing that is involved," said Oliver Friedrichs, a senior manager in Symantec's security response team. "Most of thevulnerabilities used in the past have the program as part of the virus."

The four new variants of the virus, which Symantec calls "Beagle," add tothe slew of slightly modified programs attempting toinfect Internet users. Virus writers have used the Bagle, NetSky andMyDoom worms to attempt to gain control of largenumbers of PCs. Comments in some of the programs have ledresearcher to believe that the authors of atleast two of the worms are competing against each other.

The latest Bagle variants add an infection mechanism, which uses a flawin Windows that was patched in August. PC users who haven't updated theoperating systems could, upon viewing an e-mail message containing thevirus, cause their system to download and run a malicious program.

However, many of the Web sites that had acted as locations from which to download the attack code have been taken offline, said Friedrichs.

Talkback - Tell Us What You Think

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity