Win32/Bagle [Threat Name] go to Threat

Win32/Bagle.AS [Threat Variant Name]

Win32/Bagle.AS is a worm that spreads via e-mail and shared folders.

When executed, the červ copies itself into the %system% folder using the following names:

In order to be executed on every system start, the worm sets the following Registry entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "wingo"="C:\WINNT\system32\wingo.exe"

E-mail addresses for further spreading are searched for in local files with one of the following extensions:

Addresses containing the following strings are avoided:

Subject of the message is one of the following:

Body of the message is one of the following:

The attachment is an executable of the worm. Its filename is one of the following:

The filename has one of the following extensions:

The worm searches for various shared folders.

The executables of the worm are copied there using the following names:

The following programs are terminated: