Content
W32/Bagle.ai@MM
- Type
- Virus
- SubType
- Discovery Date
- 07/19/2004
- Length
- Varies
- Minimum DAT
- 4379 (07/19/2004)
- Updated DAT
- 4900 (11/20/2006)
- Minimum Engine
- 5.1.00
- Description Added
- 07/19/2004
- Description Modified
- 02/03/2005 3:29 PM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
-- Update February 3, 2005
--
The assessment of this threat has been downgraded to Low-Profiled due to a decrease in prevalence.
--
This is a mass-mailing worm with the following characteristics:
- contains its own SMTP engine to construct outgoing messages
- harvests email addresses from the victim machine
- the From: address of messages is spoofed
- attachment can be a password-protected zip file, with the password included in the message body.
- contains a remote access component (notification is sent to hacker)
- copies itself to folders that have the phrase shar in the name (such as common peer-to-peer applications; KaZaa, Bearshare, Limewire, etc)
- uses various mutex names selected from those W32/Netsky variants have used, in order to prevent those W32/Netsky variants running on infected machines
- terminates processes of security programs and other worms
- deletes registry entries of security programs and other worms
Mail Propagation
The details are as follows:
From :
(address is spoofed)
Subject :
- Re:
Body Text:
- >foto3 and MP3
- >fotogalary and Music
- >fotoinfo
- >Lovely animals
- >Animals
- >Predators
- >The snake
- >Screen and Music
The worm will add the following body text if the attachment is sent as a password-protected ZIP file.
- Password: (random number)
- Pass - (random number)
- Key - (random number)
Attachment: (with extension .EXE, .SCR, .COM, .CPL or .ZIP)
- MP3
- Music_MP3
- New_MP3_Player
- Cool_MP3
- Doll
- Garry
- Cat
- Dog
- Fish
Password-protected ZIP files may also contain a second, randomly-named file with one of the following extensions:
- .ini
- .cfg
- .txt
- .doc
- .vxd
- .def
- .dll
Installation
The virus copies itself into the Windows System directory as WinXP.exe. For example:
- C:\WINNT\SYSTEM32\WinXP.exe
It also creates other files in this directory to perform its functions:
- %SysDir% \WinXP.exeopen
- %SysDir% \WinXP.exeopenopen
- %SysDir% \WinXP.exeopenopenopen
- %SysDir% \WinXP.exeopenopenopenopen
The following Registry key is added to hook system startup:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run "key" = %SysDir% \WinXP.exe
A mutex is created to ensure only one instance of the worm is running at a time. One of the following mutex names is used in an attempt to stop particular variants of W32/Netsky running on the infected machine:
- 'D'r'o'p'p'e'd'S'k'y'N'e't'
- _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
- [SkyNet.cz]SystemsMutex
- AdmSkynetJklS003
- ____--->>>>U<<<<--____
- _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
The worm opens port 1080 (TCP) and port 1040 (UDP) on the victim machine.
Symptoms
Method of Infection
Mail Propagation
This virus constructs messages using its own SMTP engine. Target email addresses are harvested from files with the following extensions on the victim machine:
- .wab
- .txt
- .msg
- .htm
- .shtm
- .stm
- .xml
- .dbx
- .mbx
- .mdx
- .eml
- .nch
- .mmf
- .ods
- .cfg
- .asp
- .php
- .pl
- .wsh
- .adb
- .tbb
- .sht
- .xls
- .oft
- .uin
- .cgi
- .mht
- .dhtm
- .jsp
The virus spoofs the sender address by using a harvested address in the From: field.
The virus avoids sending itself to addresses containing the following:
- @microsoft
- rating@
- f-secur
- news
- update
- anyone@
- bugs@
- contract@
- feste
- gold-certs@
- help@
- info@
- nobody@
- noone@
- kasp
- admin
- icrosoft
- support
- ntivi
- unix
- bsd
- linux
- listserv
- certific
- sopho
- @foo
- @iana
- free-av
- @messagelab
- winzip
- winrar
- samples
- abuse
- panda
- cafee
- spam
- pgp
- @avp.
- noreply
- local
- root@
- postmaster@
Peer To Peer Propagation
Files are created in folders that contain the phrase shar :
- Microsoft Office 2003 Crack, Working!.exe
- Microsoft Windows XP, WinXP Crack, working Keygen.exe
- Microsoft Office XP working Crack, Keygen.exe
- Porno, sex, oral, anal cool, awesome!!.exe
- Porno Screensaver.scr
- Serials.txt.exe
- KAV 5.0
- Kaspersky Antivirus 5.0
- Porno pics arhive, xxx.exe
- Windows Sourcecode update.doc.exe
- Ahead Nero 7.exe
- Windown Longhorn Beta Leak.exe
- Opera 8 New!.exe
- XXX hardcore images.exe
- WinAmp 6 New!.exe
- WinAmp 5 Pro Keygen Crack Update.exe
- Adobe Photoshop 9 full.exe
- Matrix 3 Revolution English Subtitles.exe
- ACDSee 9.exe
Process Killing
The worm kills processes matching the following list of file names, belonging to other worms and products which could be used to identify or interfere with its actions:
- OUTPOST.EXE
- NMAIN.EXE
- NORTON_INTERNET_SECU_3.0_407.EXE
- NPF40_TW_98_NT_ME_2K.EXE
- NPFMESSENGER.EXE
- NPROTECT.EXE
- NSCHED32.EXE
- NTVDM.EXE
- NVARCH16.EXE
- KERIO-WRP-421-EN-WIN.EXE
- KILLPROCESSSETUP161.EXE
- LDPRO.EXE
- LOCALNET.EXE
- LOCKDOWN.EXE
- LOCKDOWN2000.EXE
- LSETUP.EXE
- AVprotect9x.exe
- CMON016.EXE
- CPF9X206.EXE
- CPFNT206.EXE
- CV.EXE
- CWNB181.EXE
- CWNTDWMO.EXE
- ICSSUPPNT.EXE
- DEFWATCH.EXE
- DEPUTY.EXE
- DPF.EXE
- DPFSETUP.EXE
- DRWATSON.EXE
- ENT.EXE
- ESCANH95.EXE
- AVXQUAR.EXE
- ESCANHNT.EXE
- ESCANV95.EXE
- AVPUPD.EXE
- EXANTIVIRUS-CNET.EXE
- FAST.EXE
- FIREWALL.EXE
- FLOWPROTECTOR.EXE
- FP-WIN_TRIAL.EXE
- FRW.EXE
- FSAV.EXE
- AUTODOWN.EXE
- FSAV530STBYB.EXE
- FSAV530WTBYB.EXE
- FSAV95.EXE
- GBMENU.EXE
- GBPOLL.EXE
- GUARD.EXE
- GUARDDOG.EXE
- HACKTRACERSETUP.EXE
- HTLOG.EXE
- HWPE.EXE
- IAMAPP.EXE
- IAMSERV.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- ICSUPPNT.EXE
- IFW2000.EXE
- IPARMOR.EXE
- IRIS.EXE
- JAMMER.EXE
- ATUPDATER.EXE
- AUPDATE.EXE
- KAVLITE40ENG.EXE
- KAVPERS40ENG.EXE
- KERIO-PF-213-EN-WIN.EXE
- KERIO-WRL-421-EN-WIN.EXE
- BORG2.EXE
- BS120.EXE
- CDP.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- AUTOUPDATE.EXE
- NAVAPW32.EXE
- NAVDX.EXE
- NAVSTUB.EXE
- NAVW32.EXE
- NC2000.EXE
- NCINST4.EXE
- AUTOTRACE.EXE
- NDD32.EXE
- NEOMONITOR.EXE
- NETARMOR.EXE
- NETINFO.EXE
- NETMON.EXE
- NETSCANPRO.EXE
- NETSPYHUNTER-1.2.EXE
- NETSTAT.EXE
- NISSERV.EXE
- NISUM.EXE
- CFIAUDIT.EXE
- LUCOMSERVER.EXE
- AGENTSVR.EXE
- ANTI-TROJAN.EXE
- ANTIVIRUS.EXE
- ANTS.EXE
- APIMONITOR.EXE
- APLICA32.EXE
- APVXDWIN.EXE
- ATCON.EXE
- ATGUARD.EXE
- ATRO55EN.EXE
- ATWATCH.EXE
- AVCONSOL.EXE
- AVGSERV9.EXE
- AVSYNMGR.EXE
- BD_PROFESSIONAL.EXE
- BIDEF.EXE
- BIDSERVER.EXE
- BIPCP.EXE
- BIPCPEVALSETUP.EXE
- BISP.EXE
- BLACKD.EXE
- BLACKICE.EXE
- BOOTWARN.EXE
- NWINST4.EXE
- NWTOOL16.EXE
- OSTRONET.EXE
- OUTPOSTINSTALL.EXE
- OUTPOSTPROINSTALL.EXE
- PADMIN.EXE
- PANIXK.EXE
- PAVPROXY.EXE
- DRWEBUPW.EXE
- PCC2002S902.EXE
- PCC2K_76_1436.EXE
- PCCIOMON.EXE
- PCDSETUP.EXE
- PCFWALLICON.EXE
- PCIP10117_0.EXE
- PDSETUP.EXE
- PERISCOPE.EXE
- PERSFW.EXE
- PF2.EXE
- AVLTMAIN.EXE
- PFWADMIN.EXE
- PINGSCAN.EXE
- PLATIN.EXE
- POPROXY.EXE
- POPSCAN.EXE
- PORTDETECTIVE.EXE
- PPINUPDT.EXE
- PPTBC.EXE
- PPVSTOP.EXE
- PROCEXPLORERV1.0.EXE
- PROPORT.EXE
- PROTECTX.EXE
- PSPF.EXE
- WGFE95.EXE
- WHOSWATCHINGME.EXE
- AVWUPD32.EXE
- NUPGRADE.EXE
- WINRECON.EXE
- WNT.EXE
- WRADMIN.EXE
- WRCTRL.EXE
- WSBGATE.EXE
- WYVERNWORKSFIREWALL.EXE
- XPF202EN.EXE
- ZAPRO.EXE
- ZAPSETUP3001.EXE
- ZATUTOR.EXE
- CFINET32.EXE
- CLEAN.EXE
- CLEANER.EXE
- CLEANER3.EXE
- CLEANPC.EXE
- CMGRDIAN.EXE
- CMON016.EXE
- CPD.EXE
- PURGE.EXE
- PVIEW95.EXE
- QCONSOLE.EXE
- QSERVER.EXE
- RAV8WIN32ENG.EXE
- REGEDT32.EXE
- REGEDIT.EXE
- UPDATE.EXE
- RESCUE.EXE
- RESCUE32.EXE
- RRGUARD.EXE
- RSHELL.EXE
- RTVSCN95.EXE
- RULAUNCH.EXE
- SAFEWEB.EXE
- SBSERV.EXE
- SD.EXE
- SETUP_FLOWPROTECTOR_US.EXE
- SETUPVAMEEVAL.EXE
- SFC.EXE
- SGSSFW32.EXE
- SH.EXE
- SHELLSPYINSTALL.EXE
- SHN.EXE
- SMC.EXE
- SOFI.EXE
- SPF.EXE
- SPHINX.EXE
- SPYXX.EXE
- SS3EDIT.EXE
- ST2.EXE
- SUPFTRL.EXE
- LUALL.EXE
- SUPPORTER5.EXE
- SYMPROXYSVC.EXE
- SYS_XP.EXE
- SYSEDIT.EXE
- SYSXP.EXE
- TASKMON.EXE
- TAUMON.EXE
- TAUSCAN.EXE
- TC.EXE
- TCA.EXE
- TCM.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- TDS-3.EXE
- TFAK5.EXE
- TGBOB.EXE
- TITANIN.EXE
- TITANINXP.EXE
- TRACERT.EXE
- TRJSCAN.EXE
- TRJSETUP.EXE
- TROJANTRAP3.EXE
- UNDOBOOT.EXE
- VBCMSERV.EXE
- VBCONS.EXE
- VBUST.EXE
- VBWIN9X.EXE
- VBWINNTW.EXE
- VCSETUP.EXE
- VFSETUP.EXE
- VIRUSMDPERSONALFIREWALL.EXE
- VNLAN300.EXE
- VNPC3000.EXE
- VPC42.EXE
- VPFW30S.EXE
- VPTRAY.EXE
- VSCENU6.02D30.EXE
- VSECOMR.EXE
- VSHWIN32.EXE
- VSISETUP.EXE
- VSMAIN.EXE
- VSMON.EXE
- VSSTAT.EXE
- VSWIN9XE.EXE
- VSWINNTSE.EXE
- VSWINPERSE.EXE
- W32DSM89.EXE
- W9X.EXE
- WATCHDOG.EXE
- WEBSCANX.EXE
- CFINET.EXE
- ICSUPP95.EXE
- MCUPDATE.EXE
- LUINIT.EXE
- MCAGENT.EXE
- MFW2EN.EXE
- MFWENG3.02D30.EXE
- MGUI.EXE
- MINILOG.EXE
- MOOLIVE.EXE
- MRFLUX.EXE
- MSCONFIG.EXE
- MSINFO32.EXE
- MSSMMC32.EXE
- MU0311AD.EXE
- NAV80TRY.EXE
- ZAUINST.EXE
- ZONALM2601.EXE
- ZONEALARM.EXE
Registry Entry Removal
In both of the following startup locations
- HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
The following keys for other worms and security products are deleted:
- "My AV"
- "Zone Labs Client Ex"
- "9XHtProtect"
- "Antivirus"
- "Special Firewall Service"
- "service"
- "Tiny AV"
- "ICQNet"
- "HtProtect"
- "NetDy"
- "Jammer2nd"
- "FirewallSvr"
- "MsInfo"
- "SysMonXP"
- "EasyAV"
- "PandaAVEngine"
- "Norton Antivirus AV'
- "KasperskyAVEng"
- "SkynetsRevenge"
- "ICQ Net"
Remote Access Component
The virus listens on TCP port 1080 and UDP port 1040 for remote connections. It attempts to notify the author that the infected system is ready to accept commands, by contacting various websites, calling a PHP script on the remote sites.
Removal
All Users
:
Use current
engine and DAT files
for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Stinger
Stinger
has been updated to include detection and removal of this threat. Download Stinger
.
McAfee System Compliance Profiler
Create a rule that matches a file
- Choose SYSTEM_DIR from the drop-down
- Type in WinXP.EXE for the file name
- Choose "File does not exist" in the next drop-down
McAfee Desktop Firewall
To prevent possibly remote access McAfee Desktop Firewall users can block incoming TCP port 1080 and UDP port 1040
McAfee Threatscan
ThreatScan signatures that can detect the W32/Bagle.ai virus are available from:
- Threatscan 2.5 - ftp.nai.com/pub/security/tsc25/updates/winnt
- Threatscan 2.1 - ftp.nai.com/pub/security/tsc20/updates/winnt
ThreatScan Signature version: 2004-07-20
ThreatScan users can detect the virus by running a ThreatScan task using the following settings:
- Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
-or-
- Select the "Other" category and "Scan All Vulnerabilities" template.
For additional information:
- Run the "ThreatScan Template Report"
- Look for module number #4080
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Characteristics
Characteristics -
-- Update February 3, 2005
--
The assessment of this threat has been downgraded to Low-Profiled due to a decrease in prevalence.
--
This is a mass-mailing worm with the following characteristics:
- contains its own SMTP engine to construct outgoing messages
- harvests email addresses from the victim machine
- the From: address of messages is spoofed
- attachment can be a password-protected zip file, with the password included in the message body.
- contains a remote access component (notification is sent to hacker)
- copies itself to folders that have the phrase shar in the name (such as common peer-to-peer applications; KaZaa, Bearshare, Limewire, etc)
- uses various mutex names selected from those W32/Netsky variants have used, in order to prevent those W32/Netsky variants running on infected machines
- terminates processes of security programs and other worms
- deletes registry entries of security programs and other worms
Mail Propagation
The details are as follows:
From :
(address is spoofed)
Subject :
- Re:
Body Text:
- >foto3 and MP3
- >fotogalary and Music
- >fotoinfo
- >Lovely animals
- >Animals
- >Predators
- >The snake
- >Screen and Music
The worm will add the following body text if the attachment is sent as a password-protected ZIP file.
- Password: (random number)
- Pass - (random number)
- Key - (random number)
Attachment: (with extension .EXE, .SCR, .COM, .CPL or .ZIP)
- MP3
- Music_MP3
- New_MP3_Player
- Cool_MP3
- Doll
- Garry
- Cat
- Dog
- Fish
Password-protected ZIP files may also contain a second, randomly-named file with one of the following extensions:
- .ini
- .cfg
- .txt
- .doc
- .vxd
- .def
- .dll
Installation
The virus copies itself into the Windows System directory as WinXP.exe. For example:
- C:\WINNT\SYSTEM32\WinXP.exe
It also creates other files in this directory to perform its functions:
- %SysDir% \WinXP.exeopen
- %SysDir% \WinXP.exeopenopen
- %SysDir% \WinXP.exeopenopenopen
- %SysDir% \WinXP.exeopenopenopenopen
The following Registry key is added to hook system startup:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run "key" = %SysDir% \WinXP.exe
A mutex is created to ensure only one instance of the worm is running at a time. One of the following mutex names is used in an attempt to stop particular variants of W32/Netsky running on the infected machine:
- 'D'r'o'p'p'e'd'S'k'y'N'e't'
- _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
- [SkyNet.cz]SystemsMutex
- AdmSkynetJklS003
- ____--->>>>U<<<<--____
- _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
The worm opens port 1080 (TCP) and port 1040 (UDP) on the victim machine.
Symptoms
Symptoms -
Method of Infection
Method of Infection -
Mail Propagation
This virus constructs messages using its own SMTP engine. Target email addresses are harvested from files with the following extensions on the victim machine:
- .wab
- .txt
- .msg
- .htm
- .shtm
- .stm
- .xml
- .dbx
- .mbx
- .mdx
- .eml
- .nch
- .mmf
- .ods
- .cfg
- .asp
- .php
- .pl
- .wsh
- .adb
- .tbb
- .sht
- .xls
- .oft
- .uin
- .cgi
- .mht
- .dhtm
- .jsp
The virus spoofs the sender address by using a harvested address in the From: field.
The virus avoids sending itself to addresses containing the following:
- @microsoft
- rating@
- f-secur
- news
- update
- anyone@
- bugs@
- contract@
- feste
- gold-certs@
- help@
- info@
- nobody@
- noone@
- kasp
- admin
- icrosoft
- support
- ntivi
- unix
- bsd
- linux
- listserv
- certific
- sopho
- @foo
- @iana
- free-av
- @messagelab
- winzip
- winrar
- samples
- abuse
- panda
- cafee
- spam
- pgp
- @avp.
- noreply
- local
- root@
- postmaster@
Peer To Peer Propagation
Files are created in folders that contain the phrase shar :
- Microsoft Office 2003 Crack, Working!.exe
- Microsoft Windows XP, WinXP Crack, working Keygen.exe
- Microsoft Office XP working Crack, Keygen.exe
- Porno, sex, oral, anal cool, awesome!!.exe
- Porno Screensaver.scr
- Serials.txt.exe
- KAV 5.0
- Kaspersky Antivirus 5.0
- Porno pics arhive, xxx.exe
- Windows Sourcecode update.doc.exe
- Ahead Nero 7.exe
- Windown Longhorn Beta Leak.exe
- Opera 8 New!.exe
- XXX hardcore images.exe
- WinAmp 6 New!.exe
- WinAmp 5 Pro Keygen Crack Update.exe
- Adobe Photoshop 9 full.exe
- Matrix 3 Revolution English Subtitles.exe
- ACDSee 9.exe
Process Killing
The worm kills processes matching the following list of file names, belonging to other worms and products which could be used to identify or interfere with its actions:
- OUTPOST.EXE
- NMAIN.EXE
- NORTON_INTERNET_SECU_3.0_407.EXE
- NPF40_TW_98_NT_ME_2K.EXE
- NPFMESSENGER.EXE
- NPROTECT.EXE
- NSCHED32.EXE
- NTVDM.EXE
- NVARCH16.EXE
- KERIO-WRP-421-EN-WIN.EXE
- KILLPROCESSSETUP161.EXE
- LDPRO.EXE
- LOCALNET.EXE
- LOCKDOWN.EXE
- LOCKDOWN2000.EXE
- LSETUP.EXE
- AVprotect9x.exe
- CMON016.EXE
- CPF9X206.EXE
- CPFNT206.EXE
- CV.EXE
- CWNB181.EXE
- CWNTDWMO.EXE
- ICSSUPPNT.EXE
- DEFWATCH.EXE
- DEPUTY.EXE
- DPF.EXE
- DPFSETUP.EXE
- DRWATSON.EXE
- ENT.EXE
- ESCANH95.EXE
- AVXQUAR.EXE
- ESCANHNT.EXE
- ESCANV95.EXE
- AVPUPD.EXE
- EXANTIVIRUS-CNET.EXE
- FAST.EXE
- FIREWALL.EXE
- FLOWPROTECTOR.EXE
- FP-WIN_TRIAL.EXE
- FRW.EXE
- FSAV.EXE
- AUTODOWN.EXE
- FSAV530STBYB.EXE
- FSAV530WTBYB.EXE
- FSAV95.EXE
- GBMENU.EXE
- GBPOLL.EXE
- GUARD.EXE
- GUARDDOG.EXE
- HACKTRACERSETUP.EXE
- HTLOG.EXE
- HWPE.EXE
- IAMAPP.EXE
- IAMSERV.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- ICSUPPNT.EXE
- IFW2000.EXE
- IPARMOR.EXE
- IRIS.EXE
- JAMMER.EXE
- ATUPDATER.EXE
- AUPDATE.EXE
- KAVLITE40ENG.EXE
- KAVPERS40ENG.EXE
- KERIO-PF-213-EN-WIN.EXE
- KERIO-WRL-421-EN-WIN.EXE
- BORG2.EXE
- BS120.EXE
- CDP.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- AUTOUPDATE.EXE
- NAVAPW32.EXE
- NAVDX.EXE
- NAVSTUB.EXE
- NAVW32.EXE
- NC2000.EXE
- NCINST4.EXE
- AUTOTRACE.EXE
- NDD32.EXE
- NEOMONITOR.EXE
- NETARMOR.EXE
- NETINFO.EXE
- NETMON.EXE
- NETSCANPRO.EXE
- NETSPYHUNTER-1.2.EXE
- NETSTAT.EXE
- NISSERV.EXE
- NISUM.EXE
- CFIAUDIT.EXE
- LUCOMSERVER.EXE
- AGENTSVR.EXE
- ANTI-TROJAN.EXE
- ANTIVIRUS.EXE
- ANTS.EXE
- APIMONITOR.EXE
- APLICA32.EXE
- APVXDWIN.EXE
- ATCON.EXE
- ATGUARD.EXE
- ATRO55EN.EXE
- ATWATCH.EXE
- AVCONSOL.EXE
- AVGSERV9.EXE
- AVSYNMGR.EXE
- BD_PROFESSIONAL.EXE
- BIDEF.EXE
- BIDSERVER.EXE
- BIPCP.EXE
- BIPCPEVALSETUP.EXE
- BISP.EXE
- BLACKD.EXE
- BLACKICE.EXE
- BOOTWARN.EXE
- NWINST4.EXE
- NWTOOL16.EXE
- OSTRONET.EXE
- OUTPOSTINSTALL.EXE
- OUTPOSTPROINSTALL.EXE
- PADMIN.EXE
- PANIXK.EXE
- PAVPROXY.EXE
- DRWEBUPW.EXE
- PCC2002S902.EXE
- PCC2K_76_1436.EXE
- PCCIOMON.EXE
- PCDSETUP.EXE
- PCFWALLICON.EXE
- PCIP10117_0.EXE
- PDSETUP.EXE
- PERISCOPE.EXE
- PERSFW.EXE
- PF2.EXE
- AVLTMAIN.EXE
- PFWADMIN.EXE
- PINGSCAN.EXE
- PLATIN.EXE
- POPROXY.EXE
- POPSCAN.EXE
- PORTDETECTIVE.EXE
- PPINUPDT.EXE
- PPTBC.EXE
- PPVSTOP.EXE
- PROCEXPLORERV1.0.EXE
- PROPORT.EXE
- PROTECTX.EXE
- PSPF.EXE
- WGFE95.EXE
- WHOSWATCHINGME.EXE
- AVWUPD32.EXE
- NUPGRADE.EXE
- WINRECON.EXE
- WNT.EXE
- WRADMIN.EXE
- WRCTRL.EXE
- WSBGATE.EXE
- WYVERNWORKSFIREWALL.EXE
- XPF202EN.EXE
- ZAPRO.EXE
- ZAPSETUP3001.EXE
- ZATUTOR.EXE
- CFINET32.EXE
- CLEAN.EXE
- CLEANER.EXE
- CLEANER3.EXE
- CLEANPC.EXE
- CMGRDIAN.EXE
- CMON016.EXE
- CPD.EXE
- PURGE.EXE
- PVIEW95.EXE
- QCONSOLE.EXE
- QSERVER.EXE
- RAV8WIN32ENG.EXE
- REGEDT32.EXE
- REGEDIT.EXE
- UPDATE.EXE
- RESCUE.EXE
- RESCUE32.EXE
- RRGUARD.EXE
- RSHELL.EXE
- RTVSCN95.EXE
- RULAUNCH.EXE
- SAFEWEB.EXE
- SBSERV.EXE
- SD.EXE
- SETUP_FLOWPROTECTOR_US.EXE
- SETUPVAMEEVAL.EXE
- SFC.EXE
- SGSSFW32.EXE
- SH.EXE
- SHELLSPYINSTALL.EXE
- SHN.EXE
- SMC.EXE
- SOFI.EXE
- SPF.EXE
- SPHINX.EXE
- SPYXX.EXE
- SS3EDIT.EXE
- ST2.EXE
- SUPFTRL.EXE
- LUALL.EXE
- SUPPORTER5.EXE
- SYMPROXYSVC.EXE
- SYS_XP.EXE
- SYSEDIT.EXE
- SYSXP.EXE
- TASKMON.EXE
- TAUMON.EXE
- TAUSCAN.EXE
- TC.EXE
- TCA.EXE
- TCM.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- TDS-3.EXE
- TFAK5.EXE
- TGBOB.EXE
- TITANIN.EXE
- TITANINXP.EXE
- TRACERT.EXE
- TRJSCAN.EXE
- TRJSETUP.EXE
- TROJANTRAP3.EXE
- UNDOBOOT.EXE
- VBCMSERV.EXE
- VBCONS.EXE
- VBUST.EXE
- VBWIN9X.EXE
- VBWINNTW.EXE
- VCSETUP.EXE
- VFSETUP.EXE
- VIRUSMDPERSONALFIREWALL.EXE
- VNLAN300.EXE
- VNPC3000.EXE
- VPC42.EXE
- VPFW30S.EXE
- VPTRAY.EXE
- VSCENU6.02D30.EXE
- VSECOMR.EXE
- VSHWIN32.EXE
- VSISETUP.EXE
- VSMAIN.EXE
- VSMON.EXE
- VSSTAT.EXE
- VSWIN9XE.EXE
- VSWINNTSE.EXE
- VSWINPERSE.EXE
- W32DSM89.EXE
- W9X.EXE
- WATCHDOG.EXE
- WEBSCANX.EXE
- CFINET.EXE
- ICSUPP95.EXE
- MCUPDATE.EXE
- LUINIT.EXE
- MCAGENT.EXE
- MFW2EN.EXE
- MFWENG3.02D30.EXE
- MGUI.EXE
- MINILOG.EXE
- MOOLIVE.EXE
- MRFLUX.EXE
- MSCONFIG.EXE
- MSINFO32.EXE
- MSSMMC32.EXE
- MU0311AD.EXE
- NAV80TRY.EXE
- ZAUINST.EXE
- ZONALM2601.EXE
- ZONEALARM.EXE
Registry Entry Removal
In both of the following startup locations
- HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
The following keys for other worms and security products are deleted:
- "My AV"
- "Zone Labs Client Ex"
- "9XHtProtect"
- "Antivirus"
- "Special Firewall Service"
- "service"
- "Tiny AV"
- "ICQNet"
- "HtProtect"
- "NetDy"
- "Jammer2nd"
- "FirewallSvr"
- "MsInfo"
- "SysMonXP"
- "EasyAV"
- "PandaAVEngine"
- "Norton Antivirus AV'
- "KasperskyAVEng"
- "SkynetsRevenge"
- "ICQ Net"
Remote Access Component
The virus listens on TCP port 1080 and UDP port 1040 for remote connections. It attempts to notify the author that the infected system is ready to accept commands, by contacting various websites, calling a PHP script on the remote sites.
Removal -
Removal -
All Users
:
Use current
engine and DAT files
for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Stinger
Stinger
has been updated to include detection and removal of this threat. Download Stinger
.
McAfee System Compliance Profiler
Create a rule that matches a file
- Choose SYSTEM_DIR from the drop-down
- Type in WinXP.EXE for the file name
- Choose "File does not exist" in the next drop-down
McAfee Desktop Firewall
To prevent possibly remote access McAfee Desktop Firewall users can block incoming TCP port 1080 and UDP port 1040
McAfee Threatscan
ThreatScan signatures that can detect the W32/Bagle.ai virus are available from:
- Threatscan 2.5 - ftp.nai.com/pub/security/tsc25/updates/winnt
- Threatscan 2.1 - ftp.nai.com/pub/security/tsc20/updates/winnt
ThreatScan Signature version: 2004-07-20
ThreatScan users can detect the virus by running a ThreatScan task using the following settings:
- Select the "Remote Infection Detection" category and "Windows Virus Checks" template.
-or-
- Select the "Other" category and "Scan All Vulnerabilities" template.
For additional information:
- Run the "ThreatScan Template Report"
- Look for module number #4080
Variants
Variants -
N/A
