New Virus Out. Attachment has tax in the name

[Oreo]

We got barraged last night by a large number of virus emails with attachments that have tax in the name (ex. Increase_in_the_tax.zip)

Just found some info on F-Secure. It's a Bagle variant.
http://www.f-secure.com/weblog/
Friday, August 12, 2005
Two certain things in life: Bagle and taxes Posted by Mikko @ 04:47 GMT

Bagle & taxes
Series of Bagle variants has been released over the last 16 hours. We detect them as Email-Worm.Win32.Bagle.cb, .cc, .cd, .ce, .cf, .cg and .ch.

These are minor variants of each other, sending emails with attachments related to Taxation, such as The_reporting_of_taxes.zip or To_reduce_the_tax.zip. Once again, these archives contain executable files with misleading icons.

Some of the archives are ZIP files, some of them are RAR files and some of them are ZIP files with a .RAR extension. The wrong extension is used by the virus apparently because some gateway filters might fail to unpack such files while many unpackers used by end users will unpack them fine.

For the record: F-Secure Internet Gatekeeper, F-Secure Anti-Virus for Microsoft Exchange and F-Secure Anti-Virus for Firewalls are able to unpack such archives fine.

[bemildred]

1. Yeah, I got one in my home directory to look at later.

Says it's a ".rar" file.

[lpbk2713]

2. I received The_reporting_of _taxes this AM as an attachment.

If the header info was reliable it came from New Zealand.


Just in case anyone has to be told ..... Don't have your E-Mail prefs set to automatically unzip any zipped files. Don't click any executable files that were sent from someone you're not sure of. If you don't know who an E-Mail with an attachment is from delete it ASAP. If there is nothing in the body of the E-Mail, delete it.