email with price.zip attached

[bootNumlock]

Is there a new virus running around over the past hour or so?

Getting more than a handful of emails containing and attached file called price.zip -- but not getting a norton message (hmmmmmm)

Just wondering.

[Vixen]

I have seen several of them show up in the ticket system also. So, I decided to run a live update on my Norton's but there are currently no new virus definitions.

[bootNumlock]

my norton actually scans it and says it is clean???

[dpyers]

Takes a while for the AV vendors to recognize a new virus, develop a fix, test it, and package it for distribution. Fix prpagation is measured in hours. Virus propagation in minutes. The viruses spread faster than the fixes.

Was reading on CERT or some similar site that they expect to see instant messager type viruses this year that infect a couple of hundred thousand machines within 30 seconds of release. They also noted the faster propagation of email born virii.

I've got a lot of anti-virus stuff in place, but have been changing my mind-set from thinking that I might not get a virus to thinking that I certainly will. Doing more frequent backups.

[Vixen]

Norton's just updated their virus definitions, so if you have live updates you can go ahead and grab them or it will download for you when you reboot.

[Silverbug]

cheers vixen & bootnumlock

[mresell]

Supposedly heuristics are "supposed" to cover this. But reality and theory don't necessarily coincide.

[dweimann]

It's a virus...or maybe a trojan...if you look at the included html file in the zip, it is a control that executes an exe. Who knows what nasty things that .exe does.

I think SP2 would block it if it tried to run.

[mresell]

Not really a problem, but glad I didn't get any.

[bigdave]

Another variant of the ubiquitous Bagle worm is now making its way across the Internet, flooding in-boxes with infected Zip files. The newest member of the Bagle family, named Bagle.AQ, arrives via an e-mail message with a spoofed sending address and no subject line. The only text in the message body is typically one or two words, either "price" or "new price."

The name of the infected Zip file that accompanies the message is some variation on that theme as well. The files often are named Price.zip or New_price.zip, and may have a number appended to the end of the file name. Bagle.AQ first appeared Monday and began circulating in earnest in the early afternoon Eastern time. Some users reported getting as many as 100 infected messages in an hour. Virus researchers said they first began seeing Bagle.AQ at about 8 a.m. Monday and have been seeing thousands of copies an hour.

Source: http://www.eweek.com/article2/0,1759,1633740,00.asp