Virus: TR/Rkit.Bagle.GL Date discovered: 30/06/2006 Type: Trojan In the wild: Yes Reported Infections: Low Distribution Potential: Low Damage Potential: Low to medium Static file: Yes File size: 38.912 Bytes MD5 checksum: 4d985cc3b434828088f380225d118fca VDF version: 6.35.00.98 IVDF version: 6.35.00.124 - Thursday, July 6, 2006
General Method of propagation: Aliases: Platforms / OS: Side effects: Files %current directory% \kavsvc.exe%current directory% \bdmcon.exe%current directory% \vsserv.exe%current directory% \bdnews.exe%current directory% \livesrv.exe%current directory% \mcupdate.exe%current directory% \frameworkservice.exe%current directory% \upgrader.exe%current directory% \apvxdwin.exe%current directory% \LuComServer_2_5.EXE%current directory% \lucomserver_2_6.exe%current directory% \drwebupw.exe%current directory% \nod32krn.exe%current directory% \a2guard.exe%current directory% \aavshield.exe%current directory% \AckWin32.exe%current directory% \ADVCHK.EXE%current directory% \AhnSD.exe%current directory% \airdefense.exe%current directory% \ALERTSVC.EXE%current directory% \ALMon.exe%current directory% \ALOGSERV.EXE%current directory% \ALsvc.exe%current directory% \amon.exe%current directory% \Anti-Trojan.exe%current directory% \AntiVirScheduler%current directory% \AntiVirService%current directory% \ANTS.EXE%current directory% \APVXDWIN.EXE%current directory% \Armor2net.exe%current directory% \ashAvast.exe%current directory% \ashDisp.exe%current directory% \ashEnhcd.exe%current directory% \ashMaiSv.exe%current directory% \ashPopWz.exe%current directory% \ashServ.exe%current directory% \ashSimpl.exe%current directory% \ashSkPck.exe%current directory% \ashWebSv.exe%current directory% \aswUpdSv.exe%current directory% \ATCON.EXE%current directory% \ATUPDATER.EXE%current directory% \ATWATCH.EXE%current directory% \AUPDATE.EXE%current directory% \AUTODOWN.EXE%current directory% \AUTOTRACE.EXE%current directory% \AUTOUPDATE.EXE%current directory% \avciman.exe%current directory% \Avconsol.exe%current directory% \AVENGINE.EXE%current directory% \avgamsvr.exe%current directory% \avgcc.exe%current directory% \AVGCC32.EXE%current directory% \AVGCTRL.EXE%current directory% \avgemc.exe%current directory% \avgfwsrv.exe%current directory% \AVGNT.EXE%current directory% \avgntdd%current directory% \avgntmgr%current directory% \AVGSERV.EXE%current directory% \AVGUARD.EXE%current directory% \avgupsvc.exe%current directory% \avinitnt.exe%current directory% \AvkServ.exe%current directory% \AVKService.exe%current directory% \AVKWCtl.exe%current directory% \AVP.EXE%current directory% \AVP32.EXE%current directory% \avpcc.exe%current directory% \avpm.exe%current directory% \AVPUPD.EXE%current directory% \AVSCHED32.EXE%current directory% \avsynmgr.exe%current directory% \AVWUPD32.EXE%current directory% \AVWUPSRV.EXE%current directory% \AVXMONITOR9X.EXE%current directory% \AVXMONITORNT.EXE%current directory% \AVXQUAR.EXE%current directory% \BackWeb-4476822.exe%current directory% \bdmcon.exe%current directory% \bdss.exe%current directory% \bdsubmit.exe%current directory% \bdswitch.exe%current directory% \blackd.exe%current directory% \blackice.exe%current directory% \cafix.exe%current directory% \ccApp.exe%current directory% \ccEvtMgr.exe%current directory% \ccProxy.exe%current directory% \ccSetMgr.exe%current directory% \CFIAUDIT.EXE%current directory% \ClamTray.exe%current directory% \ClamWin.exe%current directory% \Claw95.exe%current directory% \Claw95cf.exe%current directory% \cleaner.exe%current directory% \cleaner3.exe%current directory% \CliSvc.exe%current directory% \CMGrdian.exe%current directory% \cpd.exe%current directory% \DefWatch.exe%current directory% \DOORS.EXE%current directory% \DrVirus.exe%current directory% \drwadins.exe%current directory% \drweb32w.exe%current directory% \drwebscd.exe%current directory% \DRWEBUPW.EXE%current directory% \ESCANH95.EXE%current directory% \ESCANHNT.EXE%current directory% \ewidoctrl.exe%current directory% \EzAntivirusRegistrationCheck.exe%current directory% \F-AGNT95.EXE%current directory% \F-PROT95.EXE%current directory% \F-Sched.exe%current directory% \F-StopW.EXE%current directory% \FAMEH32.EXE%current directory% \FAST.EXE%current directory% \FCH32.EXE%current directory% \FireSvc.exe%current directory% \FireTray.exe%current directory% \FIREWALL.EXE%current directory% \fpavupdm.exe%current directory% \freshclam.exe%current directory% \FRW.EXE%current directory% \fsav32.exe%current directory% \fsavgui.exe%current directory% \fsbwsys.exe%current directory% \fsdfwd.exe%current directory% \FSGK32.EXE%current directory% \fsgk32st.exe%current directory% \fsguiexe.exe%current directory% \FSM32.EXE%current directory% \FSMA32.EXE%current directory% \FSMB32.EXE%current directory% \fspex.exe%current directory% \fssm32.exe%current directory% \gcasDtServ.exe%current directory% \gcasServ.exe%current directory% \GIANTAntiSpywareMain.exe%current directory% \GIANTAntiSpywareUpdater.exe%current directory% \GUARD.EXE%current directory% \GUARDGUI.EXE%current directory% \GuardNT.exe%current directory% \HRegMon.exe%current directory% \Hrres.exe%current directory% \HSockPE.exe%current directory% \HUpdate.EXE%current directory% \iamapp.exe%current directory% \iamserv.exe%current directory% \ICLOAD95.EXE%current directory% \ICLOADNT.EXE%current directory% \ICMON.EXE%current directory% \ICSSUPPNT.EXE%current directory% \ICSUPP95.EXE%current directory% \ICSUPPNT.EXE%current directory% \IFACE.EXE%current directory% \INETUPD.EXE%current directory% \InocIT.exe%current directory% \InoRpc.exe%current directory% \InoRT.exe%current directory% \InoTask.exe%current directory% \InoUpTNG.exe%current directory% \IOMON98.EXE%current directory% \isafe.exe%current directory% \ISATRAY.EXE%current directory% \ISRV95.EXE%current directory% \ISSVC.exe%current directory% \JEDI.EXE%current directory% \KAV.exe%current directory% \kavmm.exe%current directory% \KAVPF.exe%current directory% \KavPFW.exe%current directory% \KAVStart.exe%current directory% \KAVSvc.exe%current directory% \KAVSvcUI.EXE%current directory% \KMailMon.EXE%current directory% \KPfwSvc.EXE%current directory% \KWatch.EXE%current directory% \livesrv.exe%current directory% \LOCKDOWN2000.EXE%current directory% \LogWatNT.exe%current directory% \lpfw.exe%current directory% \LUALL.EXE%current directory% \LUCOMSERVER.EXE%current directory% \Luupdate.exe%current directory% \MCAGENT.EXE%current directory% \mcmnhdlr.exe%current directory% \mcregwiz.exe%current directory% \Mcshield.exe%current directory% \MCUPDATE.EXE%current directory% \mcvsshld.exe%current directory% \MINILOG.EXE%current directory% \MONITOR.EXE%current directory% \MonSysNT.exe%current directory% \MOOLIVE.EXE%current directory% \MpEng.exe%current directory% \mpssvc.exe%current directory% \MSMPSVC.exe%current directory% \myAgtSvc.exe%current directory% \myagttry.exe%current directory% \navapsvc.exe%current directory% \NAVAPW32.EXE%current directory% \NavLu32.exe%current directory% \NAVW32.EXE%current directory% \NDD32.EXE%current directory% \NeoWatchLog.exe%current directory% \NeoWatchTray.exe%current directory% \NISSERV%current directory% \NISUM.EXE%current directory% \NMAIN.EXE%current directory% \nod32.exe%current directory% \nod32krn.exe%current directory% \nod32kui.exe%current directory% \NORMIST.EXE%current directory% \notstart.exe%current directory% \npavtray.exe%current directory% \NPFMNTOR.EXE%current directory% \npfmsg.exe%current directory% \NPROTECT.EXE%current directory% \NSCHED32.EXE%current directory% \NSMdtr.exe%current directory% \NssServ.exe%current directory% \NssTray.exe%current directory% \ntrtscan.exe%current directory% \NTXconfig.exe%current directory% \NUPGRADE.EXE%current directory% \NVC95.EXE%current directory% \Nvcod.exe%current directory% \Nvcte.exe%current directory% \Nvcut.exe%current directory% \NWService.exe%current directory% \OfcPfwSvc.exe%current directory% \OUTPOST.EXE%current directory% \PAV.EXE%current directory% \PavFires.exe%current directory% \PavFnSvr.exe%current directory% \Pavkre.exe%current directory% \PavProt.exe%current directory% \pavProxy.exe%current directory% \pavprsrv.exe%current directory% \pavsrv51.exe%current directory% \PAVSS.EXE%current directory% \pccguide.exe%current directory% \PCCIOMON.EXE%current directory% \pccntmon.exe%current directory% \PCCPFW.exe%current directory% \PcCtlCom.exe%current directory% \PCTAV.exe%current directory% \PERSFW.EXE%current directory% \pertsk.exe%current directory% \PERVAC.EXE%current directory% \PNMSRV.EXE%current directory% \POP3TRAP.EXE%current directory% \POPROXY.EXE%current directory% \prevsrv.exe%current directory% \PsImSvc.exe%current directory% \QHM32.EXE%current directory% \QHONLINE.EXE%current directory% \QHONSVC.EXE%current directory% \QHPF.EXE%current directory% \qhwscsvc.exe%current directory% \RavMon.exe%current directory% \RavTimer.exe%current directory% \Realmon.exe%current directory% \REALMON95.EXE%current directory% \Rescue.exe%current directory% \rfwmain.exe%current directory% \Rtvscan.exe%current directory% \RTVSCN95.EXE%current directory% \RuLaunch.exe%current directory% \SAVAdminService.exe%current directory% \SAVMain.exe%current directory% \savprogress.exe%current directory% \SAVScan.exe%current directory% \SCAN32.EXE%current directory% \ScanningProcess.exe%current directory% \sched.exe%current directory% \sdhelp.exe%current directory% \SERVIC~1.EXE%current directory% \SHSTAT.EXE%current directory% \SiteCli.exe%current directory% \smc.exe%current directory% \SNDSrvc.exe%current directory% \SPBBCSvc.exe%current directory% \SPHINX.EXE%current directory% \spiderml.exe%current directory% \spidernt.exe%current directory% \Spiderui.exe%current directory% \SpybotSD.exe%current directory% \SPYXX.EXE%current directory% \SS3EDIT.EXE%current directory% \stopsignav.exe%current directory% \swAgent.exe%current directory% \swdoctor.exe%current directory% \SWNETSUP.EXE%current directory% \symlcsvc.exe%current directory% \SymProxySvc.exe%current directory% \SymSPort.exe%current directory% \SymWSC.exe%current directory% \SYNMGR.EXE%current directory% \TAUMON.EXE%current directory% \TBMon.exe%current directory% \TC.EXE%current directory% \tca.exe%current directory% \TCM.EXE%current directory% \TDS-3.EXE%current directory% \TeaTimer.exe%current directory% \TFAK.EXE%current directory% \THAV.EXE%current directory% \THSM.EXE%current directory% \Tmas.exe%current directory% \tmlisten.exe%current directory% \Tmntsrv.exe%current directory% \TmPfw.exe%current directory% \tmproxy.exe%current directory% \TNBUtil.exe%current directory% \TRJSCAN.EXE%current directory% \Up2Date.exe%current directory% \UPDATE.EXE%current directory% \UpdaterUI.exe%current directory% \upgrepl.exe%current directory% \Vba32ECM.exe%current directory% \Vba32ifs.exe%current directory% \vba32ldr.exe%current directory% \Vba32PP3.exe%current directory% \VBSNTW.exe%current directory% \vchk.exe%current directory% \vcrmon.exe%current directory% \vrmonsvc.exe%current directory% \vrrw32.exe%current directory% \VSECOMR.EXE%current directory% \Vshwin32.exe%current directory% \vsmon.exe%current directory% \vsserv.exe%current directory% \VsStat.exe%current directory% \WATCHDOG.EXE%current directory% \WebProxy.exe%current directory% \Webscanx.exe%current directory% \VetTray.exe%current directory% \VirusKeeper.exe%current directory% \VPTRAY.EXE%current directory% \vrfwsvc.exe%current directory% \VRMONNT.EXE%current directory% \hidn1.exe%current directory% \hidn1.exe%current directory% \WEBTRAP.EXE%current directory% \WGFE95.EXE%current directory% \Winaw32.exe%current directory% \winroute.exe%current directory% \winss.exe%current directory% \winssnotify.exe%current directory% \WRADMIN.EXE%current directory% \WRCTRL.EXE%current directory% \xcommsvr.exe%current directory% \zatutor.exe%current directory% \ZAUINST.EXE%current directory% \zlclient.exe%current directory% \zonealarm.exe%current directory% \_AVP32.EXE%current directory% \_AVPCC.EXE%current directory% \_AVPM.EXE%current directory% \bdoesrv.exe%current directory% \bdnews.exe%current directory% \hidn.exe%current directory% \hidn1.exe Process termination Rootkit Technology Hides the following: Method used:
Description inserted by Adriana Popa on Monday, December 4, 2006
Back
.
.
.
.
