Content
W32/Bagle.ci
- Type
- Virus
- SubType
- Downloader
- Discovery Date
- 09/19/2005
- Length
- 17Kb Zip file
- Minimum DAT
- 4584 (09/19/2005)
- Updated DAT
- 5301 (05/22/2008)
- Minimum Engine
- 5.1.00
- Description Added
- 09/19/2005
- Description Modified
- 09/19/2005 2:18 PM (PT)
Tab Navigation
Characteristics
This Bagle variant has been mass spammed and arrives in a ZIP file. It is heuristically detected as 'Virus or variant New Poly Win32' by 4424 DATS and above.
This variant copies itself to the %WinDir% \system32 as WINSHOST.EXE and adds the following registry hooks:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DownloadManager
* HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run "winshost.exe" = %WinDir% \system32\winshost.exe
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "winshost.exe" = %WinDir% \system32\winshost.exe
It drops a file wiwshost.exe which is detected by 4424 DATs and above as W32/Bagle.gen@MM . This file gets injected into the EXPLORER process and tries to download a file osa6.gif from various sites. (Refer to Symptoms). It also terminates security services like its predecessors and in some cases renames the main security program executable.
Sets to "disable" the following services:
* HKLM\System\CurrentControlSet\Services\wuauserv
* HKLM\System\CurrentControlSet\Services\SharedAccess
* HKLM\System\CurrentControlSet\Services\vsmon
* HKLM\System\CurrentControlSet\Services\Alerter
* HKLM\System\CurrentControlSet\Services\wuauserv
* HKLM\System\CurrentControlSet\Services\McShield
* HKLM\System\CurrentControlSet\Services\McAfeeFramework
* HKLM\System\CurrentControlSet\Services\McTaskManager
Attempts to delete the following keys:
* HKLM\SOFTWARE\Symantec
* HKLM\SOFTWARE\McAfee
* HKLM\SOFTWARE\KasperskyLab
* HKLM\SOFTWARE\Agnitum
* HKLM\SOFTWARE\Panda Software
* HKLM\SOFTWARE\Zone Labs
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Symantec NetDriver Monitor
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ccApp
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
NAV CfgWiz
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SSC_UserPrompt
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
McAfee Guardian
* HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
McAfee.InstantUpdate.Monitor
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
APVXDWIN
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
KAV50
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
avg7_cc
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
avg7_emc
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zone Labs Client
It also modifies the file %WinDir% \system32\drivers\etc\hosts to prevent the user and any running software from contacting certain security websites. The trojanized hosts file is detected as "trojan QHosts" since DAT version 4354.
Symptoms
Services with the following names are stopped: This variant attempts to rename the following files: It also tries to kill the following processes:
Outgoing TCP connections to port 80 (HTTP) are established, and it tries to download a file from the following list (Note: Many Bagle variants attempt to download files from a very large list of sites; in fact most of the sites listed are actually believed to be decoys and were never found to be hosting anything malicious):
Method of Infection
This variant has been mass-spammed.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Characteristics
Characteristics -
This Bagle variant has been mass spammed and arrives in a ZIP file. It is heuristically detected as 'Virus or variant New Poly Win32' by 4424 DATS and above.
This variant copies itself to the %WinDir% \system32 as WINSHOST.EXE and adds the following registry hooks:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DownloadManager
* HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run "winshost.exe" = %WinDir% \system32\winshost.exe
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "winshost.exe" = %WinDir% \system32\winshost.exe
It drops a file wiwshost.exe which is detected by 4424 DATs and above as W32/Bagle.gen@MM . This file gets injected into the EXPLORER process and tries to download a file osa6.gif from various sites. (Refer to Symptoms). It also terminates security services like its predecessors and in some cases renames the main security program executable.
Sets to "disable" the following services:
* HKLM\System\CurrentControlSet\Services\wuauserv
* HKLM\System\CurrentControlSet\Services\SharedAccess
* HKLM\System\CurrentControlSet\Services\vsmon
* HKLM\System\CurrentControlSet\Services\Alerter
* HKLM\System\CurrentControlSet\Services\wuauserv
* HKLM\System\CurrentControlSet\Services\McShield
* HKLM\System\CurrentControlSet\Services\McAfeeFramework
* HKLM\System\CurrentControlSet\Services\McTaskManager
Attempts to delete the following keys:
* HKLM\SOFTWARE\Symantec
* HKLM\SOFTWARE\McAfee
* HKLM\SOFTWARE\KasperskyLab
* HKLM\SOFTWARE\Agnitum
* HKLM\SOFTWARE\Panda Software
* HKLM\SOFTWARE\Zone Labs
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Symantec NetDriver Monitor
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ccApp
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
NAV CfgWiz
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SSC_UserPrompt
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
McAfee Guardian
* HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
McAfee.InstantUpdate.Monitor
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
APVXDWIN
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
KAV50
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
avg7_cc
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
avg7_emc
* HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zone Labs Client
It also modifies the file %WinDir% \system32\drivers\etc\hosts to prevent the user and any running software from contacting certain security websites. The trojanized hosts file is detected as "trojan QHosts" since DAT version 4354.
Symptoms
Symptoms -
Services with the following names are stopped: This variant attempts to rename the following files: It also tries to kill the following processes:
Outgoing TCP connections to port 80 (HTTP) are established, and it tries to download a file from the following list (Note: Many Bagle variants attempt to download files from a very large list of sites; in fact most of the sites listed are actually believed to be decoys and were never found to be hosting anything malicious):
Method of Infection
Method of Infection -
This variant has been mass-spammed.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
