More info on blocking the Bagle worm

[kUdtiHaEX]

Zanimljiva poruka sa news gupa:

This possible worm outbreak warning was received on TH-Research (The
Trojan Horses Research Mailing List) from Moosoft Development
(www.moosoft.com) a few hours ago.

AV and AT firms have had a few hours to update their databases.

Info can be found only on Kaspersky's web page, so far:
http://www.viruslist.com/eng/alert.html?id=783050

Let's hope it is stopped before it can do too much damage!

This email comes and an heads-up and FYI so you can take measures to
stop it.

Gadi Evron

The Trojan Horses Research Mailing List - http://ecompute.org/th-list

Since it does not appear on the URL provided (again below, on viruslist,
not the Kaspersky web page, oops, sorry).

From MooSoft (Daniel):

Here is the URL list, all 404 last I checked:
http://www.elrasshop.de/1.php
http://www.it-msc.de/1.php
http://www.getyourfree.net/1.php
http://www.dmdesign.de/1.php
http://64.176.228.13/1.php
http://www.leonzernitsky.com/1.php
http://216.98.136.248/1.php
http://216.98.134.247/1.php
http://www.cdromca.com/1.php
http://www.kunst-in-templin.de/1.php
http://vipweb.ru/1.php
http://antol-co.ru/1.php
http://www.bags-dostavka.mags.ru/1.php
http://www.5x12.ru/1.php
http://bose-audio.net/1.php
http://www.sttngdata.de/1.php
http://wh9.tu-dresden.de/1.php
http://www.micronuke.net/1.php
http://www.stadthagen.org/1.php
http://www.beasty-cars.de/1.php
http://www.polohexe.de/1.php
http://www.bino88.de/1.php
http://www.grefrathpaenz.de/1.php
http://www.bhamidy.de/1.php
http://www.mystic-vws.de/1.php
http://www.auto-hobby-essen.de/1.php
http://www.polozicke.de/1.php
http://www.twr-music.de/1.php
http://www.sc-erbendorf.de/1.php
http://www.montania.de/1.php
http://www.medi-martin.de/1.php
http://vvcgn.de/1.php
http://www.ballonfoto.com/1.php
http://www.marder-gmbh.de/1.php
http://www.dvd-filme.com/1.php
http://www.smeangol.com/1.php


Viruslist has this info on it:

http://www.viruslist.com/eng/alert.html?id=783050


Daniel Otis-Vigil
MooSoft Development
http://www.moosoft.com


Gadi Evron

The Trojan Horses Research Mailing List - http://ecompute.org/th-list

Although some AV firms web pages still call this a "not so serious"
threat, the latest checks and cross-checks between vendors which are
members of TH-Research (The Trojan Horses Research Mailing List)
conclude that this is a serious Outbreak.

I believe new threat levels will be posted tomorrow morning, but it is
no longer a *possible* outbreak, it is BIG.


New information on the worm:

Status of the web pages this worm tries to connect to is still unclear.

Some vendors report it downloading a certain Trojan, but we see no
information on that so far since the web pages status is still unclear,
as mentioned.

Mcafee also reports it listening on port 6777.

The worm tries to connect to the following hacked box: 151.201.0.39.

Finally now all AV products "speak" of this worm.
Response times for detecting/cleaning/webpages updates were not so good.

As I mentioned earlier, Kaspersky and The Cleaner (MooSoft) were the
noticeable exceptions.

FYI.

Gadi Evron.

The Trojan Horses Research Mailing List - http://ecompute.org/th-list