Name:
Bagle.V wormAlso known as:
W32/Bagle.V@MM, W32/Beagle.V@MM, WORM_BAGLE.VType:
Mass-mailing email wormDiscovered:
March 29, 2004Email characteristics:
Bagle.V emails have an empty subject line, no message body, and carry an attached file named game.exe. The sender's address is spoofed.System impact:
Bagle.V drops a copy of itself to the Windows System directory as sysinfo.exe and modifies the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
adding the vaule:
"sysinfo.exe" = %sysdir%\sysinfo.exe
where %sysdir% represents the path to the user's Windows System directory.
Bagle.V also adds the following registry key:
HKEY_CURRENT_USER\Software\Windows2005Bagle.V opens TCP port 4751 and sends notice to the worm's author.
Manual removal:
Use the Windows Task Manager to shutdown the sysinfo process. Delete the registry modifications made. Delete sysinfo.exe.
