WORM_BAGLE.AZ

[Mobo]

As of January 27, 2005 1:42 AM PST (Pacific Standard Time/GMT -8:00), TrendLabs has declared a Medium Risk Virus Alert to control the spread of WORM_BAGLE.AZ. TrendLabs has received several infection reports indicating that this malware is spreading in US, China, and Japan.

This WORM_BAGLE variant arrives on a system as an email attachment. It sends copies of itself to all email addresses it gathers from files with certain extensions but skips those addresses that contain particular strings.

Users must be wary of the email that it sends with the following details:

Subject: (any of the following)
Delivery service mail
Delivery by mail
Registration is accepted
Is delivered mail
You are made active

Message body: (any of the following)
<div class='quotetop'>QUOTE</div><div class='quotemain'>Thanks for use of our software.
Before use read the help

Attachments: (any of the following file names)
guupd02
Jol03
siupd02
upd02
viupd02
wsd01
zupd02

(with any of the following extensions)
COM
CPL
EXE
SCR[/b][/quote]

The email is spoofed and may appear to have come from a familiar email address. As a general rule, users should avoid opening the attachments of unsolicited email.