New Worm Shuts Down Antivirus Shields

NU Online News Service, March 2, 12:14 p.m.,EST?Agents and home offices using virus protection mayhave their defenses penetrated by a new "worm" recently detected byMoscow, Russia-based Kaspersky Lab.[@@]

Kaspersky, a security content management company, said it hasdetected a number of variants of Email-Worm.Win32.Bagle. A worm isa destructive program that can reproduce itself and make a computerslow down significantly or stop.

The worm is launched when the user clicks on the attachment,said Kaspersky. Bagle copies itself into the Windows system folder,then stops processes that protect individual computers and localnetworks, leaving them open to further attack.

According to Kaspersky, these new Bagles are variants ofpreviously known malware, but with an important difference. "Onething they all have in common is that they don't self-replicate. Inother words, these are so-called intended variants, not fullyfunctional versions" the security firm said. Kaspersky added thatit has seen large numbers of these variants being mass-mailed asspam.

"The new Bagles were sent as attachment to infected e-mails withrandom or missing subjects and texts," Kaspersky noted. "Themalware arrives as a Windows executable file. The name, form andsize of the files are also random. It is difficult therefore toidentify the infected e-mails using formal attributes, and wecaution all users to be especially cautious when opening emailattachments.

"Kaspersky Lab virus analysts have detected 15 pieces of malwareby the author of Bagle. They are closely related and differ mostlyin the packing routines," the company said. Detailed informationand a description are available on www.viruslist.com.