Scoop has an Ethical Paywall
Work smarter with a Pro licence Learn More

Video | Business Headlines | Internet | Science | Scientific Ethics | Technology | Search


Massive outbreak of aggressive new Bagle worm var.

AUCKLAND NZ - October 29, 2004

Massive outbreak of aggressive new Bagle worm variant.

Today, a massive epidemic of an aggressive new Bagle worm hit the Internet, spreading fast and infecting thousands of machines.

At 07:51 this morning (Central European Time) a new virus was detected on NOD32’s Virus Radar project (

Initially, around 50 samples were detected in the first hour, but it quickly became obvious that the spread was going to be massive, as in the second hour, over 3400 were detected and further analysis showed that the virus was a new, and highly aggressive version of the Bagle worm, which NOD32 named Win32/Bagle.AS.

Subsequently, a further two variants were discovered - both detected with NOD32’s Advanced Heuristics - Bagle.AT and Bagle.AU, of which .AU is now also spreading.

Less than 2 hours after heuristic detection, at 09:40 (CET), an update was released to provide exact named identification and removal for each variant, and a description of the major variant Bagle.AS was posted to the NOD32 website.

“The massive proliferation of the new worm is probably due to it having its own mass-mailing routine. When the worm is active on an infected computer it will attempt to stop some antivirus and firewall applications running on the machine, so this will increase it’s chances of survival, as some products will not update and detect it.” said Andrew Lee, Senior Vice President of Global Support at NOD32.

Win32/Bagle causes a serious security breach by opening Port 81 on the computer and a random UDP port, and listens for instructions to be sent to it. The worm will be deactivated on an infected computer automatically after causing damage for 20 days. Based on the code analysis, the life cycle of the worm will end on April 25, 2006.

Advertisement - scroll to continue reading

Are you getting our free newsletter?

Subscribe to Scoop’s 'The Catch Up' our free weekly newsletter sent to your inbox every Monday with stories from across our network.

A free cleaning tool for the worm is available at

Tracking the threat on the virus radar shows the rapid growth of this worm in hours after initial heuristic detection, as can be seen in this hourly breakdown.

29.10.2004 7:00 53
29.10.2004 8:00 3409
29.10.2004 9:00 11235
29.10.2004 10:00 30424
29.10.2004 11:00 74236

Currently, the virus radar shows that around 1 in 20 messages contain the Win32/Bagle.AS worm

Rather fittingly, this morning, NOD32 received the news that they had been awarded their 29th VB100% award, a record breaking unbroken run, unmatched by any other anti-virus product, for detecting all viruses in the wild.

The exceptional advanced heuristic capabilities of NOD32, which at last measure, could detect over 88% of all viruses in-the-wild without the need for an update, are a major part of that success.


© Scoop Media

Advertisement - scroll to continue reading
Business Headlines | Sci-Tech Headlines

GenPro: General Practices Begin Issuing Clause 14 Notices

GenPro has been copied into a rising number of Clause 14 notices issued since the NZNO lodged its Primary Practice Pay Equity Claim against General Practice employers in December 2023.More

SPADA: Screen Industry Unites For Streaming Platform Regulation & Intellectual Property Protections

In an unprecedented international collaboration, representatives of screen producing organisations from around the world have released a joint statement.More


Join Our Free Newsletter

Subscribe to Scoop’s 'The Catch Up' our free weekly newsletter sent to your inbox every Monday with stories from across our network.