[SOLVED] Where is Worm.Bagle.AT?

kaz2100 · 08-29-2010, 06:41 PM

Hya,

The other day, I downloaded a mail archive (text file, almost 150000 lines).

When it was scanned by clamscan,

Code:

>cat suspicious_File | clamscan -
stdin: Worm.Bagle.AT FOUND

Worm.Bagle.AT shows up.

Web search says that Worm.Bagle comes as mail attachment.

So, I tried to identify where worm is.

Step 1. spilt into small files.

Code:

 split -l 10000 suspicious_file

Step 2. which part worm resides.

Code:

 clamscan xa*
xaa:OK
.
           (many lines)

----------- SCAN SUMMARY -----------
Known viruses: 820141
Engine version: 0.96.1
Scanned directories: 0
Scanned files: 15
Infected files: 0
Data scanned: 13.10 MB
Data read: 5.26 MB (ratio 2.49:1)
Time: 36.063 sec (0 m 36 s)

Then the worm is gone. ???

T thought that worm was cut by split command, so I used different size fraction, then result is same.

I am totally lost.

Can anybody please explain this situation?

14moose · 08-29-2010, 08:14 PM

Hi -

The worm was probably never a threat to your Linux system.

It's carried in the payload of your e-mail, which is in the MIME attachement. MIME is uuencoded; the payload are some files which are in turn encoded in a .zip file.

You can get details about a similar worm here:
http://www.cromwell-intl.com/securit...e/bagel.z.html

'Hope that helps

Luckily · 08-30-2010, 05:32 AM

Bagle.A is a worm without destructive effects that spreads via e-mail in a message with the subject Hi and an attached file with a name that consists of several random characters and has an EXE extension. Bagle.A attempts to connect to several web pages through the port 6777, in order to update itself and make an inventory of the affected users. However, these web pages have been disabled. In addition, it has code that allows it to download files from the Internet and run them on the affected computer.So do not hesitate to remove it from your computer!
Maybe you can get some help here: http://www.instantspywareremoval.com

kaz2100 · 09-06-2010, 12:06 AM

Hya,

Thank you for your replies.

The reason clamscan did not detect worm in fragmented files might be:
Fragmented files do not look like mail archive (do not start with From line).

I cut that archive into 2300+ pieces at every "From ..." line, I know where worm resides in that archive, it is exterminated.

Happy Penguins!