Alias:W32.Beagle.A@mm, I-Worm.Bagle, WORM_BAGLE.A
Type:Worm 
Size:15,872 bytes 
Origin:unknown 
Date:01-18-2004 
Damage:sends itself by email 
VDF Version:6.23.00.34 
Danger:Low 
Distribution:Medium 

General DescriptionWorm/Bagle.A is an email worm of 15,872 bytes size. It copies itself in Windows System, searches the local drives for email addresses and sends itself to them. It is active only until 28th of January.

Symptoms* When the worm is launched, calc.exe is started.

Distribution* Sends itself via email using its own smtp engine

Technical DetailsWorm/Bagle.A sends itself by email. Such an email has the following characteristics:

Subject:
Hi

Body:
Test =)
<%random characters%>
---
Test, yep.

Attachment:
<%random file name%>.exe

When the attachment is opened, the worm copies itself in Windows as BBEAGLE.EXE and it runs Windows CALC.EXE as camouflage. The program file of the worm will use as disguise the icon of the same CALC.EXE.

It makes the following registry entry, in order to be automatically activated by the next system start:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run]
"d3update.exe" = "%system%\bbeagle.exe"

Additional entries are made:

[HKEY_CURRENT_USER\Software\Windows98]
"uid" = "[%%]"
"frun" = "1"

The worm searches all email addresses in files with the following extensions: .wab, .txt, .htm, .html, .r1 and sends itself to these addresses using its own SMTP engine. The sender address is also spoofed. Worm/Bagle.A tries to download files from a web site into "/bsupld" directory below Windows.

The worm has a backdoor function, mailing itself to a static address (be***lantic.net) at start, to inform the author. The worm is waiting for further instructions on TCP port 6777. By 28th of January 2004 Worm/Bagle.A is inactive and it ends all performing actions.

Manual Remove Instructions- for Windows 2000/XP:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear.

Delete the following files:

C:\%WinDIR%\System32\BBEAGLE.EXE

Start "regedit" after that and delete the following registry entries:

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run]
"d3update.exe" = "%system%\bbeagle.exe"

* [HKEY_CURRENT_USER\Software\Windows98]
"uid" = "[%%]"
"frun" = "1"

Restart your computer.

- for Windows 9x/Me:
In order to remove the virus by hand, you should be in Safe Mode first. Press the F8 key when you start your computer, and select the 'safe mode' option that will appear.

Delete the following files:

C:\%WinDIR%\System\BBEAGLE.EXE

Start "regedit" after that and delete the following registry entries:

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run]
"d3update.exe" = "%system%\bbeagle.exe"

* [HKEY_CURRENT_USER\Software\Windows98]
"uid" = "[%%]"
"frun" = "1"

Restart your computer.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .