W32/Bagle.CL Trojan

 Information about the W32/Bagle.CL Trojan:

W32/Bagle.CL is an trojan. The trojan will infect Windows systems and spreads through email.

This trojan arrives as an email attachment. The name of the infected attachment will be;

price.zip

This file contains price_list.exe which is a copy of trojan.

Upon execution, the trojan copies itself as winshost.exe in the Windows System folder.

It also drops a file wiwshost.exe in the Windows System folder.

The trojan modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This trojan connects to some of the websites in its pre-configured list and downloads osa6.gif.

It also tries to terminate some of the security related processes.

This trojan first appeared on September 19, 2005.

 Other names of W32/Bagle.CL Trojan:

This trojan is also known as W32/Bagle.cl.