New virus??

[Randal, Phil]

We've received a couple of dozen since around 01:30 GMT.
 
I've submitted a sample to virustotal.com, jotti.org, clamav.net and
McAfee's webimmune.net.
 
virustotal.com  identifies it as W32.Bagle.bg (Kapersky), W32/Bagle.bl
(F-Prot).
 
virusscan.jotti.org calls it various things -
Trojan.Dropper.Win32.FreshBind.11.b (and variants thereof).
 
webimmune.net detected it heuristically as a Bagle variant, but McAfee's
latest daily test DATs didn't pick it up.
 
Well done Bitdefender.
 
Cheers,
 
Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]
On Behalf Of Roger Jochem
Sent: 01 March 2005 09:05
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: New virus??

I'm receiving lots of this warnings too, only from bitdefender...
      ----- Original Message -----
From: David While
To: MAILSCANNER at JISCMAIL.AC.UK
Sent: Tuesday, March 01, 2005 6:30 AM
Subject: New virus??

I have just started to receive the following warnings. It
appears that only Bitdefender currently spots this virus (I
run Bitdefender, ClamAV, F-Prot and Antivir).
 
Anyone else seeing it??
 

The following e-mails were found to have: Bad Filename
Detected : Virus Detected

Sender: xxxx at xxxxxxxxxxIP Address: 65.116.165.251

Recipient: belfast at boys-brigade.org.uk

Subject:

MessageID: j215N9QK011410

Report: Bitdefender: Found virus BehavesLike:Win32.SiteHijack
in file price_new.zip

Bitdefender: Found virus BehavesLike:Win32.SiteHijack in file
prs_03.exe

MailScanner: Executable DOS/Windows programs are dangerous in
email (prs_03.exe)

No programs allowed (prs_03.exe)

Report: Bitdefender: Found virus BehavesLike:Win32.SiteHijack
in file prs_03.exe

MailScanner: Executable DOS/Windows programs are dangerous in
email (prs_03.exe)

No programs allowed (prs_03.exe)

 

--

MailScanner

Email Virus Scanner

www.mailscanner.info

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!