Email-Worm.Win32.Bagle.eb
02 Nov 2005 17:42:00 +0300
Kaspersky Lab has detected a new Bagle variant: Email-Worm.Win32.Bagle.eb.
The worm has been widely spammed. It arrives in an archive file 7KB in size. The name of the attached archive file varies widely. Possible file names include "business.zip", "sms_text.zip", "info_prices.zip". The archive contains an executable file, "text5546.exe", which is 9675 bytes in size ((MD5 checksum: 4a68d23367d8aaf9fe9217f7f9f98bf1).
This executable file will download another version of the worm, Bagle.eh, to the infected machine via the Internet.
The Kaspersky Virus Lab has received numerous reports of infection from users around the world.
An urgent update has been released. Users are strongly recommended to update their antivirus databases.
Further details of the worm will be available in the Virus Encyclopaedia in the near future.