Bagle toasts Windows firewall

Earlier this year Microsoft released a major security update for Windows XP, which was designed to strengthen the operating system’s defences against attack from viruses and hackers. One major part of the update was an improved version of its firewall software.

Graham Cluley, senior technology consultant at antivirus firm Sophos, said the latest Bagle variants are designed to attack and disable Microsoft’s new firewall application.

"Just because you are running the latest version of Windows XP you shouldn't think you are necessarily protected from this worm. If it infects a PC running Windows XP SP2 the worm can turn off its firewall and open the door to hackers and other internet attacks," said Cluley.

Neil Campbell, the national security manager at internet security specialists Dimension Data, said it is common for viruses and worms to try and disable any firewall and antivirus programs on the system.

Campbell said the latest version of Microsoft's Windows firewall is a "huge leap forward" when compared to the previous version but he recommends that users should install a third party firewall for better protection.

"There is a window of opportunity when the system boots and loads the network and before the third party firewall becomes active. Windows firewall gives you good coverage during that time," said Campbell.

Email security firm MessageLabs said it had intercepted around 900,000 copies of the new Bagle variants this weekend and expects that figure to peak later today as people in Europe and the US switch on their computers.

David Banes, technical director of MessageLabs in Asia Pacific, told silicon.com's sister site ZDNet Australia that the company sees around one per cent of all internet traffic, so picking up almost one million copies over a weekend is very significant. But he expects the worm to start fading as users update their security software over the next few days.

"I imagine that when we look back at the end of this week we will see a dip in interceptions on Sunday – when the whole world is offline – and then they will peak on Monday and tail off again by the end of the week," said Banes.

Munir Kotadia writes for ZDNet Australia.