There seems to be another Variant with the same desciption as in my message before but the exe in the zip-file is named 12.exe

This is not detected by F-Prot and Mcafee. Virustotal says:

Antivirus Version Update Result
AntiVir 6.32.0.6 11.23.2005 TR/Bagle.EC
Avast 4.6.695.0 11.23.2005 Win32:Beagle-FR
AVG 718 11.23.2005 I-Worm/Bagle
Avira 6.32.0.6 11.23.2005 TR/Bagle.EC
BitDefender 7.2 11.23.2005 Trojan.Bagle.BK
CAT-QuickHeal 8.00 11.23.2005 (Suspicious) - DNAScan
ClamAV devel-20051108 11.23.2005 no virus found
DrWeb 4.33 11.23.2005 no virus found
eTrust-Iris 7.1.194.0 11.23.2005 no virus found
eTrust-Vet 11.9.1.0 11.23.2005 no virus found
Fortinet 2.48.0.0 11.23.2005 suspicious
F-Prot 3.16c 11.23.2005 no virus found
Ikarus 0.2.59.0 11.23.2005 no virus found
Kaspersky 4.0.2.24 11.23.2005 no virus found
McAfee 4634 11.22.2005 no virus found
NOD32v2 1.1300 11.23.2005 probably unknown NewHeur_PE virus
Norman 5.70.10 11.23.2005 no virus found
Panda 8.02.00 11.23.2005 no virus found
Sophos 3.99.0 11.23.2005 no virus found
Symantec 8.0 11.22.2005 no virus found
TheHacker 5.9.1.043 11.23.2005 no virus found
VBA32 3.10.5 11.23.2005 suspected of Email-Worm.Bagle.22

For all who can't simple block exe inside zips as suggested by John, it's mabe a good idea to temporaly add BANEXT EXE and BANEZIPS ON to your config and try to update virus signatures.
 
Markus
 

Reply via email to