Precisa de ajuda? Peça à comunidade ou contrate um perito.
Acesse a Avira Answers
Alias:WORM_BAGLE.AB, W32/Bagle.ab@mm
Size:~67 kB 
Damage:Sent by email 
VDF Version: 

General DescriptionAffected Operating Systems:
Microsoft Windows 9x/ME/NT/2000/XP/Server 2003

DistributionWorm/Bagle.ab searches the system for email addresses, having one of the following extensions:


The worm uses its own SMTP Engine. An email sent by Worm/Bagle.ab has the following structure:

Subject: (one of the following lines)

Encrypted document
Fax Message
Forum notify
Incoming message
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
RE: Incoming Msg
RE: Message Notify
Re: Msg reply
RE: Protected message
RE: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo! Site changes Update
Body: (one of the following lines)
Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach. See attach.
See the attached file for details.
Your document is attached.
Your file is attached.
Attachment: (one of the following files)
Info M
The attachment has one of the following extensions:

Worm/Bagle.ab has a backdoor component, which communicates over TCP Port 1234.

Technical DetailsAttention: Worm/Bagle.ab has an identical functionality with Worm/
When activated, Worm/Bagle.ab shows the a window:

Title: Error!

Text: Can't find viewer associated with the file

The worm generates 7 different Mutexes to hinder Worm/NetSky activity:

[]SystemsMutex AdmSkynetJklS003 _--->>>>U<<<<--____ _-
oO]xX|-S-k-y-N-e-t-|Xx[Oo-_'D'r'o'p'p'e'd'S'k'y'N'e't' -oOaxX|-+S+-+k+-+y+-
+N+-+e+-+t+-|XxKOo-_ MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D

It deletes the following application keys from Windows Registry:



containing one of the following strings:

"My AV"
"Zone Labs Client Ex"
"Special Firewall Service"
"Tiny AV"
"Norton Antivirus AV"
"ICQ Net"

Worm/Bagle.ab creates the following files:


and the following entry in Windows Registry:

"reg_key" = "%System%\loader_name.exe"

The worm copies itself in all directories containing the string "Shar", with the
following file names:

ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Kaspersky Antivirus 5.0
KAV 5.0
Matrix 3 Revolution English Subtitles.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Opera 8 New!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
Porno, sex, oral, anal cool, awesome!!.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe
Descrição enviada por Crony Walker em terça-feira, 15 de junho de 2004

Voltar . . . .