W32/Bagle.F Worm

 Information about the W32/Bagle.F Worm:

W32/Bagle.F is a mass mailing memory resident worm. The worm infects Windows systems and spreads through email.

The worm contains its own SMTP engine to construct outgoing messages using a spoofed return address to several email addresses gathered from the infected system.

The subject and body of the infected mail will be random. It carries an infected attachment with random filename with any one of the following extensions;

.exe
.scr
.zip

The attached file has a similar icon as a Windows folder

This worm spreads by dropping infected files in folders that have the text string 'shar' in their file names.

Upon execution, the worm drops the following files in the Windows system folder:

go54o.exe
ii5nj4.exe
i1ru54n4.exe

The worm also alters the windows registry at the following location to load itself during next startup;

HKEY_USERS\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm creates the mutex, imain_mutex to ensure that only one instance of the worm is running in memory.

This worm first appeared on 29th February, 2004.

 Other names of W32/Bagle.F Worm:

This Worm is also known as WORM_BAGLE.F, W32/Bagle.f@MM, Bagle.F.