Bagle toasts Windows firewall
November 01 2004
by Munir Kotadia
More virus fun for Microsoft customers...
Earlier this year Microsoft released a major security update for Windows XP, which was designed to strengthen the operating system’s defences against attack from viruses and hackers. One major part of the update was an improved version of its firewall software.
Graham Cluley, senior technology consultant at antivirus firm Sophos, said the latest Bagle variants are designed to attack and disable Microsoft’s new firewall application.
"Just because you are running the latest version of Windows XP you shouldn't think you are necessarily protected from this worm. If it infects a PC running Windows XP SP2 the worm can turn off its firewall and open the door to hackers and other internet attacks," said Cluley.
Neil Campbell, the national security manager at internet security specialists Dimension Data, said it is common for viruses and worms to try and disable any firewall and antivirus programs on the system.
Campbell said the latest version of Microsoft's Windows firewall is a "huge leap forward" when compared to the previous version but he recommends that users should install a third party firewall for better protection.
"There is a window of opportunity when the system boots and loads the network and before the third party firewall becomes active. Windows firewall gives you good coverage during that time," said Campbell.
Email security firm MessageLabs said it had intercepted around 900,000 copies of the new Bagle variants this weekend and expects that figure to peak later today as people in Europe and the US switch on their computers.
David Banes, technical director of MessageLabs in Asia Pacific, told silicon.com's sister site ZDNet Australia that the company sees around one per cent of all internet traffic, so picking up almost one million copies over a weekend is very significant. But he expects the worm to start fading as users update their security software over the next few days.
"I imagine that when we look back at the end of this week we will see a dip in interceptions on Sunday – when the whole world is offline – and then they will peak on Monday and tail off again by the end of the week," said Banes.
Munir Kotadia writes for ZDNet Australia.
W32/Bagle-AU attempts to terminate the following processes:
alogserv.exe
APVXDWIN.EXE
ATUPDATER.EXE
ATUPDATER.EXE
AUPDATE.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
Avconsol.exe
AVENGINE.EXE
AVPUPD.EXE
Avsynmgr.exe
AVWUPD32.EXE
AVXQUAR.EXE
AVXQUAR.EXE
bawindo.exe
blackd.exe
ccApp.exe
ccEvtMgr.exe
ccProxy.exe
ccPxySvc.exe
CFIAUDIT.EXE
DefWatch.exe
DRWEBUPW.EXE
ESCANH95.EXE
ESCANHNT.EXE
FIREWALL.EXE
FrameworkService.exe
ICSSUPPNT.EXE
ICSUPP95.EXE
LUALL.EXE
LUCOMS~1.EXE
mcagent.exe
mcshield.exe
MCUPDATE.EXE
mcvsescn.exe
mcvsrte.exe
mcvsshld.exe
navapsvc.exe
navapsvc.exe
navapsvc.exe
navapw32.exe
NISUM.EXE
nopdb.exe
NPROTECT.EXE
NPROTECT.EXE
NUPGRADE.EXE
NUPGRADE.EXE
OUTPOST.EXE
PavFires.exe
pavProxy.exe
pavsrv50.exe
Rtvscan.exe
RuLaunch.exe
SAVScan.exe
SHSTAT.EXE
SNDSrvc.exe
symlcsvc.exe
UPDATE.EXE
UpdaterUI.exe
Archived topic from Iceteks, old topic ID:2816, old post ID:23056
