ウイルス情報

ベーグル・F

( W32.Bagle.F.IWorm )

メール添付ファイルから感染する［メール無断送信］ワーム

別名＿：

--

更新日：

2004年2月29日(日)

■感染したらどうなる

• パソコン内のメールアドレスを自動で探し出し、ウイルスを添付したメールを送信しますが、メールソフトで送るわけではないので、特に自覚症状はありません。インターネット接続時にアイコンをタスクトレイ表示する設定にしていて、何もしていないのにアイコンが点滅する場合は要注意です。

■感染しないためには

• メールに添付された添付ファイルを実行しないようにしてください。
  添付ファイルのファイル名はランダムに変化しますが、使用される拡張子は「.EXE、.SCR、.ZIP」です。

■どうすれば直る

• 「ウイルスセキュリティ」は、すでにこのウイルスに対応済みです。ご安心ください。

■詳細情報

• 差送信されるメールの形式は以下の通りですのでご注意ください。
  送信者:詐称されています。
  
  件名:以下のいずれかになります。
  ^_^ meay-meay!
  ^_^ mew-mew (-:
  Aline
  Anna
  Audra
  Bad girl
  Barbi
  beautiful
  Caitie
  caroline
  ello! =))
  Fotograf
  Gallery photos
  groom
  Hey, dude, it's me ^_^ :P
  Hey, ya! =))
  Hi! :-)
  Hokki =)
  Jammie
  Juli
  Julie
  kate
  Katrina
  Kelley
  kleopatra
  Lisa
  Mandy
  Mary
  Mary-Anne
  My beautiful person
  My Name is Frenk
  My photoalbum
  My photos
  Myphotos
  Photoalbum
  rebecca
  Rena
  
• 大量メール送信
  このウイルスは、ハードディスク内を検索して、以下の拡張子のファイルから、ウイルスのコピーの送り先とするためのメールアドレスを抜き取ります。
  .adb
  .asp
  .cfg
  .dbx
  .eml
  .htm
  .html
  .mdx
  .mmf
  .nch
  .ods
  .php
  .pl
  .sht
  .txt
  .wab
  
  しかし、以下のメールアドレスに対しては送信されません。
  @avp.
  @hotmail.com
  @microsoft
  @msn.com
  local
  noreply
  postmaster@
  root@
  
  ※このウイルスは、2005年3月25日（木）に感染活動を停止するようにプログラムされています。
  Sara
  stacy
  Tammy
  Wau... beautiful (-:
  Weah, hello! :-)
  Weeeeee! ;)))
  
  本文:以下のいずれかになります。
  Argh, i don't like the plaintext :)
  Fell free to chat with me I accept all ages. Don''''t worry I don''''t bite........hope to hear from you soon!
  If you are going to make me cry, at least be there to wipe away the tears *Right now the worst thing for you to tell me that I can find someone better than you, especially when you are all I want
  You don't know what you致e got till it痴 gone *You hurt me more than I deserve, how can you be so cruel? I love you more than you deserve, how can I be such a fool?
  I sit with elders of a gentle race, whose world is seldom seen.Who sit and talk of days for which they wait, when all will be revealed. These are song lyrics.
  I'm a social butterfly and a natural flirt. Very hard to get my complete attention. Very open and will answer almost anything. But please don't piss me off. I can be sweet and cuddly or a whatever mood I am in that day so everyday
  Love the outdoors, literature, writing, and athletics
  When The Trust is Gone So Is The Love That Fades Like the Rain Washing Away All The Sorrows Of Yesterday Why I Ask Myself Must It End Like This Tomorrow, I Tell Myself, I'll Be Okay For Now, I'll Just Live In The Memories Of Our Life Together
  I enjoy clean conversations but am open to conversing with women and men with little ones as well. I am very open-minded. All authorization requests will be denied if I don't receive messages and get to know you first.
  I love camping, dirt track racing, going for walks, and I have 2 cats - HotRod and Deebo (named from the movie 'Friday' and he lives up to it!). Life is ever changing, never always easy...
  i love to chat to just about anyone!!
  If I'm online, it problably means I'm pretty bored....so feel free to message me and say hi or whatever else comes to mind at the moment.
  Hey people whats goin on? If there is anything you want to know about me ask me... I am pretty easygoing I won't bite....not at first anywayz hahaa.....one thing I will say on here tho I am not into the Cyber thing so don't even ask.....Ciao...
  Hi! My name is Shreya and I am a goof off!!! So, If you love the outdoors, travelling, books, music, movies, laffing, teasing and/or can poke fun at yourself... please come a hollerin'!!
  I love to dance, read poetry, make people laugh, and hug as many people a day as i can.
  Single Mom of 3, Full time college student, Graduate in December with an Associates of Applied Science in Computer Information Systems Love the internet.
  My hobbies include crochet, sewing, painting lead figures and playing AD&D. Favorite activities include fishing and camping. I love cats, unicorns(go figure), and fantasy in general.
  I like to be in a company of smart, delicate, and with a good sense of humor people. I am Bulgarian, currently getting my Master's in International Business in USA. Favorite actor: Michael Dudikoff
  i'm tall and skiny I'm studying in Pharm. D program in FL. i like music, movie, dancing, sports, SCUBA diving, traveling and make a lot friends.
  Nice friends, nice men, nice sex and feeling great. I don't mind the odd bout of cybersex as I love to use my imagination when I masterbate.
  Hey, guys! by the way, I have no problems with my sexual life, so it's absolutly useless try to have icq sex or things like that. Thanks
  I'm an open minded person and enjoy chatting w/ other people. I'm free and willing to chat about anything. So feel free to Imed me if you wanna chat.
  I love meeting new people and making new friends. I am a Mary Kay Beauty Consultant. I am married to a wonderful man. We have no children, exept for a minature schnauzer that thinks he is a child. Looking forward to meeting you.
  I am from Taiwan but I study in Camden, New Jersey now. I like to know people from different places .
  I'm married and I stay at home. And I don't do cyber sex so leave me the f**k alone
  Looking forward for a response :P
  
  添付ファイルがパスワードで保護されたzipファイルである場合、メッセージの一部に以下のいずれかが含まれます。
  archive password: %password%
  password: %password%
  pass: %password%
  
  添付ファイル:ファイル名は以下のいずれかになります。
  Aline
  Anna
  Audra
  Bad girl
  Barbi
  Caitie
  caroline
  Gallery
  It_I
  Jammie
  Juli
  Julie
  kate
  Katrina
  Katrina
  Kelley
  kleopatra
  Lisa
  Mandy
  Mary
  Mary-Anne
  myfotos
  Photoalbum
  Photomontage
  Picture
  rebecca
  Rena
  Sara
  stacy
  Tammy
  
  使用される拡張子は.exe、.scr、.zipのいずれかです。解凍するとフォルダのアイコンを装ったファイルが現われます。
  添付ファイルを実行すると、ワームがシステムディレクトリにインストールされて、以下のファイルをコピーします。
  1ru54n4.exe
  go54o.exe
  ii5nj4.exe
  i1ru54n4.exeopen
  
• 以下のレジストリの値を作成します。
  HKEY_CURRENT_USER?Software?Microsoft?Windows? CurrentVersion?Run "rate.exe" =
  C:?WINNT?SYSTEM32?i1ru54n4.exe
  HKEY_CURRENT_USER?Software?winword "frun"
  
• 以下のプログラムを強制終了します。
  ATUPDATER.EXE
  ATUPDATER.EXE
  AUPDATE.EXE
  AUTODOWN.EXE
  AUTOTRACE.EXE
  AUTOUPDATE.EXE
  AVLTMAIN.EXE
  AVPUPD.EXE
  AVWUPD32.EXE
  AVXQUAR.EXE
  CFIAUDIT.EXE
  DRWEBUPW.EXE
  ICSSUPPNT.EXE
  ICSUPP95.EXE
  LUALL.EXE
  MCUPDATE.EXE
  NUPGRADE.EXE
  NUPGRADE.EXE
  OUTPOST.EXE
  UPDATE.EXE