I don't know why but it's useful to know that most dodgie emails have
spelling or grammar errors. This one has *resposible*. I wonder if it is
an unofficial code of practice for the scum-bags who send them out?
Barry H
Greetings,
A news release about a virus, I received a message as described in the top
part of this text, AVG said it was clean, but when my email program, Agent,
attempted to save the .zip file, it came up and said there was an encoding
error. I therefore returned the whole message to it's sender but the
message bounced, so good job my email program could not save it then eh?
I would not have executed the file without further virus checks.
so, beware.
Trend Micro Medium Risk Virus Alert - WORM_BAGLE.BE From: "Trend Micro Newsletters Editor" <editor@xxxxxxxxxxxxxxxxxxxxxxxxxx> Date: Tue, 1 Mar 2005 05:12:06 -0800
Dear Trend Micro customer,
As of March 1, 2005, 3:43 AM (GMT - 08:00), TrendLabs has declared a Medium
Risk Virus Alert to control the spread
of WORM_BAGLE.BE. TrendLabs has received numerous infection reports indicating that this malware is spreading in
New Zealand and Australia.
Initial analysis shows that this worm drops a copy of itself as WINDLHHL.EXE in the Windows system folder upon execution. It then mass-mails copies of TROJ_BAGLE.BE, which is resposible for downloading WORM_BAGLE.BE. The email that it sends out has the following details:
Subject: <blank>
Message Body: price
Attachment: <.ZIP copy of the TROJ_BAGLE.BE
TrendLabs will be releasing the following EPS deliverables:
TMCM Outbreak Prevention Policy 153 Official Pattern Release 2.456.00 Damage Cleanup Template 544
For more information on WORM_BAGLE.BE, you can visit our Web site at: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.BE
You can modify subscription settings for Trend Micro newsletters at:
http://www.trendmicro.com/subscriptions/default.asp
----------------------------------------------o0o----
IMPORTANT NOTE!
TrendLabs will also be releasing a 3-digit pattern file 990 that
corresponds with the pattern indicated in this email. This 3-digit pattern
is a special release for users running non-NPF compliant products (i.e.,
old 3-digit pattern format) and is designed to provide protection against
the most current malware threats. Users running non-NPF compliant products
are still urged to apply the NPF solution
<http://www.trendmicro.com/en/support/npf/overview.htm>. These users may also upgrade to the latest product version. Only NPF-compliant products will be able to update with regular pattern releases.
______________________________________________________________________ This message was sent by Trend Micro's Newsletters Editor using Responsys Interact (TM).
To unsubscribe from Trend Micro's Newsletters Editor:
http://trendnewsletter.rsc03.net/servlet/optout?mgLDXCVDUEJhspgFqptiRDKLthgDJhDNrE0
To update your subscription preference, or to change your email address:
http://trendnewsletter.rsc03.net/servlet/website/PersonalizedForm?mgLEwkLMLkLgJL9LgmLk.40hktELtHpsEJhspgFqptiRDKLthgDJhDNrEhE3vyf_87.3de.26_8.26
To view our permission marketing policy: http://www.rsvp0.net Copyright 1989-2004 Trend Micro, Inc. All rights reserved Trend Micro, Inc., 10101 N. De Anza Blvd., Suite 200, Cupertino, CA 95014
-- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.300 / Virus Database: 266.5.2 - Release Date: 28/02/2005
All the best
from:
Colin R. Howard. ** To leave the list, click on the immediately-following link:- ** [mailto:access-uk-request@xxxxxxxxxxxxx?subject=unsubscribe] ** If this link doesn't work then send a message to: ** access-uk-request@xxxxxxxxxxxxx ** and in the Subject line type ** unsubscribe ** For other list commands such as vacation mode, click on the ** immediately-following link:- ** [mailto:access-uk-request@xxxxxxxxxxxxx?subject=faq] ** or send a message, to ** access-uk-request@xxxxxxxxxxxxx with the Subject:- faq
** To leave the list, click on the immediately-following link:- ** [mailto:access-uk-request@xxxxxxxxxxxxx?subject=unsubscribe] ** If this link doesn't work then send a message to: ** access-uk-request@xxxxxxxxxxxxx ** and in the Subject line type ** unsubscribe ** For other list commands such as vacation mode, click on the ** immediately-following link:- ** [mailto:access-uk-request@xxxxxxxxxxxxx?subject=faq] ** or send a message, to ** access-uk-request@xxxxxxxxxxxxx with the Subject:- faq