Protection busting Bagle virus strikes

The latest version of the Bagle virus attempts to turn off nearly 300 antivirus processes it finds running on infected computers. Sophos alerted users yesterday to Bagle-AA, which is also known as Bagle-AB and Bagle-Z, advising it had already received many reports. Trend Micro had issued a yellow alert for its customers. In common with its predecessors, this latest Bagle arrives as an email with short texts in the subject and an attachment. If run, the attachment generates a dialog box with the message 'Can't find a viewer associated with the file'.

The worm harvests email addresses from the system to build email messages in which it sends itself on and places copies of itself in any folders with 'shar' as part of the name. It copies itself here under filenames that might tempt peer-to-peer users into uploading it.

Read Full Story