Alias:Email-Worm.Win32.Bagle.*, W32/Bagle.dll.dr, Trojan.Tooso.F, TROJ_BAGLE.B*, Troj/BagleDl, Win32.Bagle.B*@mm
Type:Trojan 
Size:36.352 Bytes 
Origin: 
Date:05-31-2005 
Damage: 
VDF Version:6.30.00.215 
Danger:Low 
Distribution:Medium 

General Description[Affected platforms]
* Windows 95
* Windows 98
* Windows ME
* Windows NT
* Windows 2000
* Windows XP
* Windows Server 2003

[Damage routine]
* terminates antivirus- und securitysoftware
* downloads other trojan components
* deletes values from the Windows Registry

Technical DetailsIf TR/Dldr.Bagle.BR is executed, it creates in the Windows system directory (on Microsoft Windows 9x <%WinDIR%>System\ and on Microsoft Windows NT/2000/XP/2003 <%WinDIR%>\System32\) the following files:

<%sysdir%>\WIWSHOST.EXE (filesize: 11.774 bytes)

The trojan adds two entries in the Windows Regsitry:

[HKEY_Current_User\Software\Microsoft\ Windows\CurrentVersion\Run]
"winshost.exe" = "<%sysdir%>\winshost.exe"

[HKEY_Local_Machine\Software\Microsoft \Windows\CurrentVersion\Run]
"winshost.exe" = "<%sysdir%>\winshost.exe"

The file WIWSHOST.EXE is actually the downloader. It is also able to affect the efficiency of antivirus- and securitysoftware.
It modifies the Windows HOSTS file, so that different web sites from software producers get blocked and thus they aren't reachable anymore.

The trojan is also able to terminate a range of processes from antivirus- and securitysoftware. To avvomplish this task, the virus terminates all active processes which contain one of the following strings within the processname:

- wuauserv
- PAVSRV
- PAVFNSVR
- PSIMSVC
- Pavkre
- PavProt
- PREVSRV
- PavPrSrv
- ccSetMgr.exe
- SPBBCSvc
- KLBLMain
- avg7alrt
- avg7updsvc
- vsmon
- CAISafe
- avpcc
- fsbwsys
- backweb client - 4476822
- backweb client-4476822
- fsdfwd
- F-Secure Gatekeeper Handler Starter
- FSMA
- KAVMonitorService
- navapsvc
- NProtectService
- Norton Antivirus Server
- VexiraAntivirus
- dvpinit
- dvpapi
- schscnt
- BackWeb Client - 7681197
- F-Secure Gatekeeper Handler Starter
- FSMA
- AVPCC
- KAVMonitorService
- Norman NJeeves
- NVCScheduler
- nvcoas
- Norman ZANDA
- PASSRV
- SweepNet
- SharedAccess
- navapsvc
- NPFMntor
- Outpost Firewall
- SAVScan
- SBService
- Symantec Core LC
- ccEvtMgr
- SNDSrvc
- ccPwdSvc
- SWEEPSRV.SYS
- NOD32ControlCenter
- NOD32Service
- PCCPFW
- Tmntsrv
- AvxIni
- XCOMM
- ravmon8
- SmcService
- BlackICE
- PersFW
- McAfee Firewall
- OutpostFirewall
- NWService
- alerter
- sharedaccess
- NISUM
- NISSERV
- vsmon
- nwclnth
- nwclntg
- nwclnte
- nwclntf
- nwclntd
- nwclntc
- wuauserv
- navapsvc
- Symantec Core LC
- SAVScan
- kavsvc
- DefWatch
- Symantec AntiVirus Client
- NSCTOP
- Symantec Core LC
- SAVScan
- SAVFMSE
- ccEvtMgr
- McShield
- AlertManger
- McAfeeFramework
- AVExch32Service
- AVUPDService
- McTaskManager
- Network Associates Log Service
- Outbreak Manager
- MCVSRte
- mcupdmgr.exe
- AvgServ
- AvgCore
- AvgFsh
- awhost32
- Ahnlab task Scheduler
- MonSvcNT
- V3MonNT
- V3MonSvc
- FSDFWD
- navapsvc
- ccSetMgr
- VisNetic AntiVirus Plug-in

The trojan is also able to terminate different system services. If the following entries are present in the Registry, TR/Dldr.Bagle deletes them:

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"Symantec NetDriver Monitor"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"ccApp"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"NAV CfgWiz"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"SSC_UserPrompt"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"McAfee Guardian"=

[HKCU\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"McAfee.InstantUpdate.Monitor"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"APVXDWIN"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"KAV50"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"avg7_cc"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"avg7_emc"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"Zone Labs Client"=

[HKLM\SOFTWARE\Symantec\]
%%

[HKLM\SOFTWARE\McAfee\]
%%

[HKLM\SOFTWARE\KasperskyLab\]
%%

[HKLM\SOFTWARE\Agnitum\]
%%

[HKLM\SOFTWARE\Panda Software\]
%%


[HKLM\SOFTWARE\Zone Labs\]

The trojan contains a list of URLs, from which it can download other components and store them into the Windows directory with different names. The URL list differs from one variant to another.
Description insérée par Crony Walker le mardi 15 juin 2004

Retour . . . .