W32/Bagle.D@mm

W32/Bagle.D@mm	Destructivity: Spreading: Overall risk:

• Detected by virus detection files published: 2/28/2004	• Type: Worm
• Virus characteristics first published: 2/28/2004	• Spreading mechanism: Email
• Virus characteristics latest update: 3/29/2004	• Overall risk: Low
• Alias:	• Payload: Backdoor, terminates AV processes.
• Infection type: Microsoft Windows 95/98/98 SE/ME/NT 4/2000/XP/2003/Vista

This is an email worm. It is very similar to W32/Bagle.C@mm.

The main differences are that the registry entry where it stores its own data is called

HKCUSOFTWAREDateTime3 (the C variant used DateTime2)

and the mutex created to stop it running multiple copies of itself is called imain_m2 instead of imain_mutex.

# - A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z

VIRUSfighter