16 November 2004

New Worm – W32.Beagle.AX@mm

A new worm has been identified, and is particularly dangerous because these e-mails have a seemingly accurate subject line. Please watch carefully, and don't open the attachement. This worm has the following characteristics:

From:

Subject: (One of the following)

Re: Msg reply, Re: Hello , Re: Yahoo! , Re: Thank you! , Re: Thanks :) , RE: Text message , Re: Document , Incoming message ,
Re: Incoming Message , RE: Incoming Msg , RE: Message Notify , Notification , Changes.. , Update , Fax Message , Protected message , RE: Protected message , Forum notify , Site changes , Re: Hi , Encrypted document

Message body: (One of the following)

Read the attach. , Your file is attached. , More info is in attach , See attach. , Please, have a look at the attached file. ,
Your document is attached. , Please, read the document. , Attach tells everything. , Attached file tells everything. ,
Check attached file for details. , Check attached file. , Pay attention at the attach. , See the attached file for details.
Message is in attach , Here is the file.

Followed by one of the following texts if the attachment is a zip file:

For security reasons attached file is password protected.
The password is [image file containing password]
For security purposes the attached file is password protected.
Password - -- [image file containing password]<
Note: Use password [image file containing password] to open archive.
Attached file is protected with the password for security reasons.
Password is [image file containing password]
In order to read the attach you have to use the following password:
[image file containing password]
Archive password:[image file containing password]
Password - [image file containing password]
Password: [image file containing password]

Attachment: (One of the following)

Information, Details, text_document, Updates, Readme, Document, Info, Details, MoreInfo, Message

followed by one of the extensions:

.hta, .vbs, .exe, .scr, .com, .cpl, .zip