Windows malware

We’re seeing Bagle deployments on a number of websites, usually a sign of increased Bagle activity to follow

We’ve just issued an alert for Nyxem.e, due to the number of reports we’ve been receiving for the past few days but also because of its destructive payload which activates on 3rd of every month.

I recently came across an interesting IRCBot which KAV detects as Backdoor.Win32.IRCBot.lo. When I took a closer look at it, I found out that it’s quite an advanced bot with a lot of features.

It’s two years to the day that the antivirus industry first encountered Bagle – Email-Worm.Win32.Bagle.a.

Sober.y will attempt to update itself tonight from a predefined set of websites in Germany and Austria.

It was only a matter of time, the first IM-Worm exploiting the wmf vulnerability has been spotted.

Another case of infected storage media

Between yesterday evening and this morning, we intercepted 12 programs created by the authors of Bagle: 5 Trojan downloaders and 7 worms.

Yes another modification. This time, not surprisingly, it’s Trojan-Downloader.Win32.Bagle.f

Sober.y, which is currently the most popular variant, started spreading actively on Monday, November 21.

For the last 24 hours or so we’ve seen a number of new Email-Worm.Win32.Sober variants, some of which we have got an alert out for.

Jerusalem caused the first major computer virus epidemic – it infected enterprises, government offices and academic institutions around the world.

Further information about the new backdoor

The spamming continues. We have just detected the latest variant – Email-Worm.Win32.Bagle.ek

The Bagles are continuing to come in. We’ve detected 6 new variants so far, and just released an urgent update.