W32/Bagle.AV@mm
| W32/Bagle.AV@mm |
Destructivity:  Spreading:  Overall risk:
|
| • Detected by virus detection files published: 1/26/2005 | • Type: Backdoor, Worm |
| • Virus characteristics first published: 1/26/2005 | • Spreading mechanism: Email, Network, Other |
| • Virus characteristics latest update: 11/28/2005 | • Overall risk: Medium |
| • Alias: W32/Bagle.bj@MM (NAI), W32.Beagle.AY@mm (Symantec), WORM_BAGLE.AY (Trend) | • Payload: Terminates AV/Firewall processes. Attempts to download material. |
| • Infection type: Microsoft Windows 95/98/98 SE/ME/NT 4/2000/XP/2003/Vista |
| Virus type |
Spreading mechanism |
Destructivity and payload |
Additional descriptions |
Detection and removal |
||||||||||
Email characteristics:
When the worm is first run, it will copy itself to the Windows System folder, and send mails containing itself as an attachment. In addition, it copies itself to folders containing the word "shar", and will thus be able to spread via many P2P networks. During installation, it will create the following mutexes: MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D. File system changes: Creates file <SYSDIR>\sysformat.exe Drops files in "shar" folders: 1.exe Registry changes: Creates key HKCU\Software\Microsoft\Windows\CurrentVersion\Run sysformat="<SYSDIR>\sysformat.exe Email spreading: Subjects used :Delivery service mail Delivery by mail Registration is accepted Is delivered mail You are made active Mail body text used : Attachment name : The worm searches local hard disks for files with the following extensions: .wab It examines these files for email addresses. It will avoid email addresses belonging to known AV companies and a few other organizations. |
||||||||||||||