New Beagle spreads on the Net
Analysts from Virus Monitoring Service of Doctor Web, Ltd. have registered appearance of a new clone of Beagle mass - mailing worms actively propagating via email and through file-sharing networks – the two most efficient and speedy ways of mass infection of computers worldwide. The worm has been labeled by Dr.Web as Win32.HLLM.Beagle.18336, with other antivirus vendors it is called W32/Bagle.bj@MM, WORM_BAGLE.AY.
The worm’s executable code arrives to users’ computers in the attached files with .com, .exe, .src or .cpl extensions. Its name consists of sequence of alpha-numeric , forexample guupd02. Being activated, it places its copies sysformat.exe, sysformat.exeopen and sysformat.exeopenopen to the Windows\System folder and points to them in the system registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Propagation via e-mail
With the help of its own SMTP engine, the worm distributes itself from already infected machines. For this, it gathers in the invaded computer mail addresses from files with definite extensions and constructs its own mail messages consisting of false sender address, a subject and a message body, which has just one srting
Thanks for use of our software
or
Before use read the help.
Propagation through file-sharing networks
The worm propagates through file-sharing networks by placing its copy into the directories which have a “shar” in their names, pretending to be a file of a popular software program, including beta version of Windown Longhorn.
Trojan activity
The body of the worm stores a considerable list of web-sites it tries to download a file error.jpg, which is a remote administration utility.
Destructive influence on a system
The worm deactivates files of different antivirus programs and cyber security applications, including the Dr.Web automatic updating utility DRWEBUPW.EXE. If a Dr.Web user fails to update the latest add-on for the virus base, it is available for manual downloading from our web-site.
It also deletes from the system registry entries
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
with the following values belonging to its competitor – the Netsky worm
Doctor Web, Ltd. strongly advises never open suspicious messages, or letters received from unknown or hardly known addressees, if such letters arrive equipped with attachments arousing suspicions. If your computer has no antivirus program installed, you can always check a suspicious file enclosed to the message in our on-line virus check through the following web-form.
Other news
|
 |
My five cents
|
 |
| |
What is the screen size of your monitor?
|
 |
|
 |
|
 |
|
