W32/Bagle.A

 Virus Information - W32/Bagle.A:

W32/Bagle.A is a mass mailing worm. This worm will infect Windows systems. The worm spreads through email.

It arrives with the following subject:

Hi

The from address of the infected mail will be spoofed from the address list of the infected system.

The body of the infected mail will be;

Test =)
<variable string>
--
Test, yep.

The infected email carries an attachment with a random file name.

Upon execution of the infected attachment, the worm checks the system date, and if the date is January 28th, 2004 or later, it terminates itself without further activity. If the system date is prior to January 28th, 2004, the worm executes and launches Windows calc.exe, and simultaneously copies itself as bbeagle.exe in the Windows\System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Windows98

The worm scans the following extensions and collects the available email addresses from the infected system.

.txt, .htm, .wab, .html

The worm mails itself to those addresses using its own SMTP engine.