Analysis of Beagle worm from SecurityFocus

[techAdmin]

There's a good analysis of the Beagle Worm, including a complete history of it's development and propagation.

Especially interesting is the section on how it tests for previously infected machines then installs newer versions of itself on only those machines, in other words, it tests for machines that are being run by users who are not doing a good job securing their machines, and only infecting those. This is a good method since it reduces greatly the registered infections, and keeps the new version off the Antivirus vendor's screens for as long as possible.