W32/Bagle@MM

[ZWarrior]

((((((((((((((((((( McAfee Dispatch )))))))))))))))))))))))

[This message is brought to you as a subscriber to the McAfee Dispatch. To unsubscribe, please follow the instructions at the bottom of this email.]

------------------------------------------------------------
          ** VIRUS ADVISORY - W32/Bagle@MM **
------------------------------------------------------------

W32/Bagle@MM is a Medium Risk mass-mailing worm with a potentially dangerous remote access component. Similar to last summer's Sobig virus, W32/Bagle@MM arrives as an executable attachment inside an email (subject line: "Hi").
When run, the virus checks the system date -- if January 28,
2004 or later, the virus simply exits and does not propagate.
Otherwise, the virus emails itself to addresses it steals from the infected computer, spoofing the "from: field" with one of the harvested addresses.

Note: The virus does not mass-mail itself to addresses that
contain:

- @hotmail.com
- @msn.com
- @microsoft
- @avp


------------------------------------------------------------
What to look for:

From:       (address may be forged)
Subject:    Hi
Body:
       Test =)
      (random characters)
      --
      Test, yep.

Attachment:   (random filename) 15,872 bytes
------------------------------------------------------------

Learn More about W32/Bagle@MM:
==> http://us.mcafee.com/root/campaign.asp?cid=9499

Scan for W32/Bagle@MM:
==> http://us.mcafee.com/root/campaign.asp?cid=9500