Troj/BagleDl-AM

Aliases	Email-Worm.Win32.Bagle.pac W32/Bagle.gen
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Drops more malware Installs itself in the registry
Protection available since	13 December 2005 10:45:15 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Troj/BagleDl-AM is a Trojan for the Windows platform.

When first run Troj/BagleDl-AM copies itself to <Windows system folder>\wintems.exe and creates the following files:

<Windows system folder>\foro.exe (Detected as Troj/BagleDl-AE)
<Windows system folder>\noat.exe (Detected as Troj/Lohav-U)

Troj/BagleDl-AM sets the following registry entry to run at startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
german.exe
<Windows system folder>\wintems.exe

Troj/BagleDl-AM sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).

Get reports about the latest virus and spyware threats delivered to your computer