Help
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Bagle.CZ - New variant uses CPL extension
This new variant was massively spammed via email and while the downloader component doesn't appear to be working, this new variant can deactivate existing AV or FW software installed on the PC. The CPL extensions are typically found inside of a zipped archieve
McAfee information on this massively spammed variant
http://vil.nai.com/vil/content/v_129588.htm
Trend information
http://secunia.com/virus_information/21411/trojbagle.cz/
Sophos information
http://www.sophos.com/virusinfo/analyses/trojdropperbc.html
ISC information
http://isc.sans.org/diary.php?storyid=665
This new variant was massively spammed via email and while the downloader component doesn't appear to be working, this new variant can deactivate existing AV or FW software installed on the PC. The CPL extensions are typically found inside of a zipped archieve
McAfee information on this massively spammed variant
http://vil.nai.com/vil/content/v_129588.htm
Trend information
http://secunia.com/virus_information/21411/trojbagle.cz/
Sophos information
http://www.sophos.com/virusinfo/analyses/trojdropperbc.html
ISC information
http://isc.sans.org/diary.php?storyid=665
Quote
Multiple new variants of this threat were recently mass spammed. Filenames include 1.cpl and price.cpl and may arrive in a ZIP file named newprice.zip , price_09.zip, price some number.zip , etc
The variants seen thus far are non functional, and deemed a low risk. The first such variant drops a corrupt file (ceeweewe.exe) to the %windir%. The corrupt file is detected as W32/Bagle.dam. Detection will be enhanced in the 4580 DAT release to detect and delete these newly discovered damaged variants. This is a generic detection covering many variants of the W32/Bagle@MM virus when sent in "CPL" format.
The variants seen thus far are non functional, and deemed a low risk. The first such variant drops a corrupt file (ceeweewe.exe) to the %windir%. The corrupt file is detected as W32/Bagle.dam. Detection will be enhanced in the 4580 DAT release to detect and delete these newly discovered damaged variants. This is a generic detection covering many variants of the W32/Bagle@MM virus when sent in "CPL" format.
Back to top
