New flavor of Bagle worm discovered

Helsinki-based F-Secure warned PC users that this version of the worm is unique because the malicious website promoted by the virus changes every four minutes.

The Finnish firm called the worm W32/Bagle.GI, adding that the virus's contents, which encourage PC users to visit the malicious website, keep changing.

One simple solution was to block access to Bagle-related malicious websites, the firm warned on its company blog.

"To make a long story short: block access to this download site. It's at endoliteindia[dot]com – a hacked web server in India," said Mikko Hypponen on the F-Secure website.

Bagle.A was first spotted in January 2004 and stopped spreading by the end of the month. Bagle.B, which was more destructive and widespread than its earlier version, began spreading in February of that year.

McAfee also reported a new sighting of the worm today, calling it Bagle.ew. The firm, ranked the trojan downloader as having a threat level of only 2 of 7.