Skip Over Navigation Links
Center for Information TechnologyAntivirus
Antivirus Home Page
Contact Us
Questions or Comments
Disclaimers

Software
Current client downloads:
VScan Engine/Dat (SuperDat) -4.3.20/4.0.4399
VirusScan Enterprise 8.0i - Windows NT/2000/XP/2003
VirusScan Enterprise 7.1 - Windows NT/2000/XP/2003
Version 4.5.1 (install Service Pack 1) - Windows 9x/ME
Virex (OS X) Engine/Def - 7.2(v1.1)/041013
Virex (OS 9.x) Engine/Def - 6.2/041001
Linux & Solaris Engine/Dat - 4.3.20/4.0.4399
Symantec Antivirus - 9.0
Ad-aware - 6.0
Clean Boot 1.0
Stinger v2.4.0 virus removal tool (Updated 9/28/04, 3:22am)
Microsoft Patch Library
Current server downloads:
VirusScan Enterprise 7.1
NetShield NetWare - 4.6.2
NetShield NetWare Engine Update - 4.3.20
ePO agent for NetWare
Sybari Antigen - 528/966
TrendMicro - 6.810/200
ScanMail eManager - 3.0
Microsoft Patch Library

Information
Configuration Tips
VirusScan FAQs
Ad-aware FAQs
Central EMail Status
VirusScan Instructions
Additional Resources
ePO 3.0/VirusScan 7.0 Presentation

Archives
List of Viruses

Virus Alerts

W32/Bagle.z@mm (aka worm_bagle.X@mm by Trend Micro) Last Updated 4/26/04 4:30PM

CIT has been notified of an email virus called W32/Bagle.z@mm. This is a mass-mailing worm that harvests email addresses from infected machines. Emails are forged to appear to be sent by an address from the @nih.gov domain. This mass-mailing worm has two attachments included. Recent email samples show a .jpg and a .cpl attachment.

From: alias@nih.gov

  • annie@ (domain of recipient)
  • christina@ (domain of recipient)
  • christy@ (domain of recipient)
  • jessie@ (domain of recipient)
  • lizie@ (domain of recipient)
  • secretGurl@(domain of recipient)

Examples of subjects lines are:

  • Hey!
  • Let's talk, my friend!
  • Hello!
  • Hey!
  • Let's socialize, my friend!
  • Let's talk, my friend!
  • I'm bored with this life
  • Notify from a known person ;-)
  • I like you
  • I just need a friend
  • I'm a sad girl...
  • Re: Msg reply
  • Re: Hello

Body: varies

Example

Hi,

(embedded .jpg image here)

I'm a young lady of 20 years old i'd like to find my second part!!!

Further details are in attach.
Cheers, SecretGurl

Attachment:(Two attachments, Possibly a .jpg and .cpl file)

Example

  • Details
  • Details
  • Document
  • Information
  • Message
  • MoreInfo
  • Readme

    NAI has released SuperDat 4353 and later to detect and remove W32/Bagle.z@mm.

    Symantec will be releasing definitions dated 4/26/04 to detect and remove beagle.w@MM.

    For more Information:

    http://vil.nai.com/vil/content/v_122415.htm from NAI.

    http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.w@mm.html from Symantec.

    http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.X From Trend Micro.

    This archive is not intended to be comprehensive. For a more complete virus library, please visit NAI's Virus Information Library at http://vil.nai.com.

    		•

    Contact TASC for assistance or call
    301.59.Go.CIT (V) 301.496.8294 (TDD)

    		 National Institutes of HealthCenter for Information Technology
    National Institutes of Health
    Bethesda, Maryland 20892

    Questions or Comments | Disclaimers

    		 Department of Health and Human ServicesHealth and Human Services
    Washington, D.C. 20201
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -