New Improved Bagle Worm Win32.Glieder! Now with Win32.Fantibag and Win32.Mitglieder   6/6/2005 - 827 views, 1 Comment

Said Chris Thomas, a security architect with Computer Associates, “We’ve seen blended threats before where a virus uses several methods to spread, but not like this.”‘

In fact, this version of Bagle is so different that it warranted a brand new name of its own, the “Glieder” designation.

Win32.Glieder starts out like any other worm - mass-emailing itself to everyone on its host’s address book list. But then the tagalong Trojan Win32.Fantibag disables the host computer’s antivirus software update mechanism, and second tagalong Trojan, Win32.Mitglieder, disables any firewalls and antivirus software that it can, and, according to TechNewsWorld, hijacks and subjugates the infected machine, making it part of an ever-expanding botnet. A botnet, in this context, is a collection of compromised PCs connected to the Internet which are used remotely by spammer and others to spam, launch denial of service attacks, and for other malicious Internet-related activities.

Win32.Glieder may, but does not necessarily, show up as an email attachment called “price.zip”.

To protect yourself against Win32.Glieder, make sure that your anti-virus software is up-to-date and that your latest update includes a definition for Win32.Glieder. And of course never, never open an unexpected or unfamiliar attachment.