New Bagle variant seen in the wild

Anti-virus software companies late Thursday and early Friday began warning e-mail users that the persistent Bagle virus has re-emerged in a new version, Bagle.AF or Beagle.AB.

The virus comes in the form of a password-protected .zip file and has the password included in the message body as plain text or within an image. According to anti-virus company F-Secure of Helsinki, Bagle.AF has quite similar functionality to Bagle.Z, which appears to indicate that the author of Bagle.AF had Bagle.Z's source code .

The first Bagle virus, which spreads throughout the Internet via infected e-mail messages and by targeting machines running Microsoft's Windows operating system, was discovered in January. Since then it has continually been popping up with new variants, and given a plethora of names by the various anti-virus companies. In March, a variant - with three names: Bagle.U, W32/Bagle.n@MM and W32/Beagle.m@MM - struck the Internet and foiled users with a small bitmap image to escape detection by anti-virus programs.

F-Secure upgraded Bagle.AF to its "Radar Level 2" alert early Friday morning after receiving several samples of it from infected users in North America and Europe, according to Mikko Hyppönen, the director of antivirus research at F-Secure.

"The beginning of the outbreak looked pretty bad, as the initial burst of infections was big and worldwide," Hyppönen said in an e-mail response to questions. "However, since then the amount of infections has leveled out and we don't expect this to become any bigger problem. It seems that the virus was seeded much more aggressively than some of the other recent Bagle variants."

Trend Micro, in Tokyo, rated the risk from the Bagel variant as "medium," though it said the damage and distribution potentials of the virus are high. McAfee, in Santa Clara, raised its risk assessment to "medium-on-watch" and warned it had the potential of being upgraded to a high-risk threat. The company said, that as of late Thursday, it had received over 100 reports of the virus, most of which came from the U.S.

Symantec upgraded its warning on what it is calling W32.Beagle.AB@mm to a "Level 3" after it received 66 submissions of infections from customers, 17 of those being from corporate customers.

The IDG News Service is a Network World affiliate.