W32/Bagle.AI

 Virus Information - W32/Bagle.AI:

W32/Bagle.AI is a mass mailing worm. This worm infects Windows systems. The worm spreads through email. The worm copies itself to folder that contain the string shar.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected email will be:

Re:

The body of the infected email will be the any one of the following;

fotoinfo
fotogalary and Music
foto3 and MP3
The snake
Screen and Music
Predators
Lovely animals
Animals

It carries any one of the following infected attachment;

New_MP3_Player
Music_MP3
MP3
Garry
Fish
Doll
Dog
Cool_MP3
Cat

The extension of the attachment may be any one of the following;

exe
scr
com
cpl
zip

Upon execution of the attachment, the worm copies itself as WINXP.EXE in the Windows System folder. It drops WINXP.EXEOPEN, WINXP.EXEOPENOPEN, WINXP.EXEOPENOPENOPEN and WINXP.EXEOPENOPENOPENOPEN which are copies of the worm.

It alters the windows registry at the following location to load itself during next startup;

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It creates several mutex to ensure only one instance of the worm is running. It terminates some variants of W32/Netsky.

____--->>>>U<<<<--____
_-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_
[SkyNet.cz]SystemsMutex
AdmSkynetJklS003
'D'r'o'p'p'e'd'S'k'y'N'e't'

The worm also tries to terminate the processes of security related softwares.

To propagate itself, the worm scans the infected machine for the files having the following extensions and collects all the available email addresses;

.xml, .xls, .wsh, .wab, .uin, .txt, .tbb, .stm, .shtm, .sht, .pl, .php, .oft, .ods, .mbx, .jsp, .htm, .eml, .dhtm, .dbx, .nch, .msg, .mmf, .mht, .mdx, .cgi, .cfg, .asp, .adb.

The worm uses its own SMTP engine to mail itself to these email addresses.