W32/Bagle-CU

Aliases	Email-Worm.Win32.Bagle.fc W32/Bagle.dv.dr Trojan.Lodav.A
Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Drops more malware Installs itself in the registry
Protection available since	17 February 2006 23:34:08 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

W32/Bagle-CU is a worm for the Windows platform.

When run, the worm opens a dialog box asking the user to 'Select file to crack'.

W32/Bagle-CU drops the Trojan Troj/BagleDl-BL. W32/Bagle-CU is a worm for the Windows platform.

When run, the worm opens a dialog box asking the user to 'Select file to crack'.

When W32/Bagle-CU is installed the following files are created:

<Temp>\<random filename>.dmp
<Windows system folder>\anti_troj.exe
<Windows system folder>\winlog.dll
<Windows system folder>\winlog.exe

The files anti_troj.exe and winlog.exe are also copied to the Temp folder under random filenames.

The file anti_troj.exe is detected as Troj/BagleDl-BL.

The following registry entries are created to run anti_troj.exe and winlog.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
key2
<Windows system folder>\winlog.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
anti_troj
<Windows system folder>\anti_troj.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
key2
<Windows system folder>\winlog.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
anti_troj
<Windows system folder>\anti_troj.exe

Registry entries are created under:

HKCU\Software\FirstRRRun\

Get reports about the latest virus and spyware threats delivered to your computer