Alias:WORM_BAGLE.AD, W32/Bagle.ad@mm
Type:Worm 
Size:~61 kBytes 
Origin: 
Date:07-06-2004 
Damage:Sent by email 
VDF Version:6.26.00.14 
Danger:Low 
Distribution:Medium 

General DescriptionOperating Systems:
Microsoft Windows 9x/ME/NT/2000/XP/Server 2003

DistributionWorm/Bagle.ad searches the system for email addresses having the following
extensions:
.wab
.txt
.msg
.htm
.shtm
.stm
.xml
.dbx
.mbx
.mdx
.eml
.nch
.mmf
.ods
.cfg
.asp
.php
.pl
.wsh
.adb
.tbb
.sht
.xls
.oft
.uin
.cgi
.mht
.dhtm
.jsp
The worm uses its own SMTP Engine. An email sent by Worm/Bagle.ad has the following structure:

Subject: (One of the following lines)
Changes..
Encrypted document
Fax Message
Forum notify
Incoming message
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
RE: Incoming Msg
RE: Message Notify
Re: Msg reply
RE: Protected message
RE: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo! Site changes Update

Body: (One of the following lines)
Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach. See attach.
See the attached file for details.
Your document is attached.
Your file is attached.

Attachment: (one of the following files)
Information
Details
text_document
Updates
Readme
Document
Info
MoreInfo
Message

The attachment has one of the following extensions:

.hta
.vbs
.exe
.scr
.com
.cpl
.zip

Worm/Bagle.ad has a backdoor component, communicating on TCP Port 1234.

Technical DetailsWhen activated, Worm/Bagle.ad shows the following window:

Title: Error!

Text: Can't find viewer associated with the file

The worm generates 7 Mutexes to hinder Worm/NetSky activity:

[SkyNet.cz]SystemsMutex AdmSkynetJklS003
_--->>>>U<<<<--____
_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_'D'r'o'p'p'e'd'S'k'y'N'e't'
-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D

It deletes the following applications from the Windows Registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run\

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run\

containing one of the following strings:
"My AV"
"Zone Labs Client Ex"
"9XHtProtect"
"Antivirus"
"Special Firewall Service"
"service"
"Tiny AV"
"ICQNet"
"HtProtect"
"NetDy"
"Jammer2nd"
"FirewallSvr"
"MsInfo"
"SysMonXP"
"EasyAV"
"PandaAVEngine"
"Norton Antivirus AV"
"KasperskyAVEng"
"SkynetsRevenge"
"ICQ Net"


Worm/Bagle.ad creates the following files:
%WinDIR%\cplstub.exe
%SystemDIR%\loader_name.exe
%SystemDIR%\loader_name.exeopen
%SystemDIR%\loader_name.exeopenopen
and the following Windows Registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run\
"reg_key" = "%System%\loader_name.exe"

The worm copies itself in all directories containing the string "Shar, with the
following file names:

ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Kaspersky Antivirus 5.0
KAV 5.0
Matrix 3 Revolution English Subtitles.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Opera 8 New!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
Porno, sex, oral, anal cool, awesome!!.exe
Serials.txt.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .