Bagle family grows

[plun]

Hi

This new member in the infamous Bagle family
must be interresting to watch with MSAS:

http://www.viruslist.com/en/viruses/encyclopedia?virusid=74841

If changes in hosts file is blocked or ?

This one really makes preparation for future attacks ;(

 

[Bill Sanderson]

This should raise alarms on at least two checkpoints--the addition to the
Run key, and the hosts file changes, I think.

I tested with a notepad change to hosts using one of the strings Symantec
reports, and Microsoft Antispyware was a little slow, but, upon blocking,
the file was as it had been before the change.

I'll be interested to see what reports we get about these alerts.