Troj/BagleDl-U is a Trojan for the Windows platform.
When first run Troj/BagleDl-U copies itself to <Windows system folder>\winshost.exe and creates the file <Windows system folder>\wiwshost.exe. Both these files are detected as Troj/BagleDl-U.
Troj/BagleDl-U is a Trojan for the Windows platform.
When first run Troj/BagleDl-U copies itself to <Windows system folder>\winshost.exe and creates the file <Windows system folder>\wiwshost.exe. Both these files are detected as Troj/BagleDl-U.
Troj/BagleDl-U attempts to inject the dropped file wiwshost.exe into the process explorer.exe.
The following registry entries are created to run winshost.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
winshost.exe
<Windows system folder>\winshost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winshost.exe
<Windows system folder>\winshost.exe
Troj/BagleDl-U sets the following registry entry:
HKCU\Software\FirstRun
FirstRunRR
1
Troj/BagleDl-U tries to run NOTEPAD.EXE the first time it is run.
Troj/BagleDl-U attempt to terminate processes and services and to delete registry entries related to security and anti-virus programs.
Troj/BagleDl-U overwrites the HOSTS file with the following single line to overwrite any settings:
127.0.0.1 localhost
Troj/BagleDl-U attempts to download and execute files from a number of remote websites to <Windows folder>\_re_file.exe. At the time of writing these files were not available for download.