Win32.Bagle.AF@mm

( WORM_BAGLE.AF, W32/Bagle.af@MM )

SYMPTOMS:

• Files:
  
  %SYSDIR%\sysxp.exe
  %SYSDIR%\sysxp.exeopen
  %SYSDIR%\sysxp.exeopenopen
  
  where %SYSDIR% is Windows System directory (eg. C:\Windows\System, C:\WinNT\System32)
  
  
• Registry key:
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  
  with the value:
  
  "key"="%SYSDIR%\sysxp.exe
  
  
• Port 1080 opened
  
  (see it using "netstat -a" at the command prompt)
  
  Regedit does not work
  

TECHNICAL DESCRIPTION:

The worm comes by mail in the following form:

The From: filed is spoofed.

Subject: one of the following:

• Re: Msg reply
  
• Re: Hello
  
• Re: Yahoo!
  
• Re: Thank you!
  
• Re: Thanks :)
  
• RE: Text message
  
• Re: Document
  
• Incoming message
  
• Re: Incoming Message
  
• RE: Incoming Msg
  
• RE: Message Notify
  
• Notification
  
• Changes..
  
• Update
  
• Fax Message
  
• Protected message
  
• RE: Protected message
  
• Forum notify
  
• Site changes
  
• Re: Hi
  
• Encrypted document

Attachment: has a .exe, .scr, .com, .zip, or .cpl extension and one of the following names:

• Information
  
• Details
  
• text_document
  
• Updates
  
• Readme
  
• Document
  
• Info
  
• Details
  
• MoreInfo
  
• Message
  
• Sources

Body text: may contain one or more of the following:

• Read the attach.
  
• Your file is attached.
  
• More info is in attach
  
• See attach.
  
• Please, have a look at the attached file.
  
• Your document is attached.
  
• Please, read the document.
  
• Attach tells everything.
  
• Attached file tells everything.
  
• Check attached file for details.
  
• Check attached file.
  
• Pay attention at the attach.
  
• See the attached file for details.
  
• Message is in attach
  
• Here is the file.
  
  
• For security reasons attached file is password protected. The password is [password]
  
• For security purposes the attached file is password protected. Password -- [password]
  
• Note: Use password [password] to open archive.
  
• Attached file is protected with the password for security reasons. Password is [password]
  
• In order to read the attach you have to use the following password: [password]
  
• Archive password: [password]
  
• Password - [password]
  
• Password: [password]

When run, the worm displays a fake error message:

Can't find a viewer associated with the file

and creates one of the following mutexes:

• |MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
  
• 'D'r'o'p'p'e'd'S'k'y'N'e't'
  
• _-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
  
• [SkyNet.cz]SystemsMutex
  
• AdmSkynetJklS003
  
• _-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_

then creates the following files:

• %SYSDIR%\\sysxp.exe -- worm executable file
  
  where %SYSDIR% is Windows System directory (eg. C:\Windows\System, C:\WinNT\System32)
  
  
•  
• %SYSDIR%\sysxp.exeopen -- worm copy with some garbage appended
  
  
• %SYSDIR%\sysxp.exeopenopen -- worm zipped (may be password protected) or the worm dropper with .cpl extension

and creates the registry key:

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  
  with the value:
  
  "key"="%SYSDIR%\sysxp.exe

The key above is created ten times per second, so deleting it will not help unless the process (sysxp.exe) is killed.

The worm tries to remove the following registry keys:

• HKCU\Software\Microsoft\Windows\My AV
  
• HKCU\Software\Microsoft\Windows\Zone Labs Client Ex
  
• HKCU\Software\Microsoft\Windows\9XHtProtect
  
• HKCU\Software\Microsoft\Windows\Antivirus
  
• HKCU\Software\Microsoft\Windows\Special Firewall Service
  
• HKCU\Software\Microsoft\Windows\service
  
• HKCU\Software\Microsoft\Windows\Tiny AV
  
• HKCU\Software\Microsoft\Windows\ICQNet
  
• HKCU\Software\Microsoft\Windows\HtProtect
  
• HKCU\Software\Microsoft\Windows\NetDy
  
• HKCU\Software\Microsoft\Windows\Jammer2nd
  
• HKCU\Software\Microsoft\Windows\FirewallSvr
  
• HKCU\Software\Microsoft\Windows\MsInfo
  
• HKCU\Software\Microsoft\Windows\SysMonXP
  
• HKCU\Software\Microsoft\Windows\EasyAV
  
• HKCU\Software\Microsoft\Windows\PandaAVEngine
  
• HKCU\Software\Microsoft\Windows\Norton Antivirus AV
  
• HKCU\Software\Microsoft\Windows\KasperskyAVEng
  
• HKCU\Software\Microsoft\Windows\SkynetsRevenge
  
• HKCU\Software\Microsoft\Windows\ICQ Net

To mail itself, the worm searches the local hard-disk for e-mail addresses inside files with the following extensions:

.wab, .txt, .msg, .htm, .shtm, .stm, .xml, .dbx, .mbx, .mdx, .eml, .nch, .mmf, .ods, .cfg, .asp, .php, .wsh, .adb, .tbb, .sht, .xls, .oft, .uin, .cgi, .mht, .dhtm, .jsp

and uses its own SMTP engine to resolve the target mail server and to send mail to it, skipping e-mail addresses that contain:

@hotmail, @msn, @microsoft, rating@, f-secur, news, update, anyone@, bugs@, contract@, feste, gold-certs@, help@, info@, nobody@, noone@, kasp, admin, icrosoft, support, ntivi, unix, linux, listserv, certific, sopho, @foo, @iana, free-av, @messagelab, winzip, google, winrar, samples, abuse, panda, cafee, spam, @avp., noreply, local, root@, postmaster@

Also the worm copies itself to directories that have shar in their names (for instance the P2P shared folders) with one of the following names:

• Microsoft Office 2003 Crack, Working!.exe
  
• Microsoft Windows XP, WinXP Crack, working Keygen.exe
  
• Microsoft Office XP working Crack, Keygen.exe
  
• Porno, sex, oral, anal cool, awesome!!.exe
  
• Porno Screensaver.scr
  
• Serials.txt.exe
  
• KAV 5.0
  
• Kaspersky Antivirus 5.0
  
• Porno pics arhive, xxx.exe
  
• Windows Sourcecode update.doc.exe
  
• Ahead Nero 7.exe
  
• Windown Longhorn Beta Leak.exe
  
• Opera 8 New!.exe
  
• XXX hardcore images.exe
  
• WinAmp 6 New!.exe
  
• WinAmp 5 Pro Keygen Crack Update.exe
  
• Adobe Photoshop 9 full.exe
  
• Matrix 3 Revolution English Subtitles.exe
  
• ACDSee 9.exe

The worm also runs as backdoor on port 1080.

It attempts to terminate/prevents execution of the following processes:

• OUTPOST.EXE
  NMAIN.EXE
  NORTON_INTERNET_SECU_3.0_407.EXE
  NPF40_TW_98_NT_ME_2K.EXE
  NPFMESSENGER.EXE
  NPROTECT.EXE
  NSCHED32.EXE
  NTVDM.EXE
  NVARCH16.EXE
  KERIO-WRP-421-EN-WIN.EXE
  KILLPROCESSSETUP161.EXE
  LDPRO.EXE
  LOCALNET.EXE
  LOCKDOWN.EXE
  LOCKDOWN2000.EXE
  LSETUP.EXE
  CLEANPC.EXE
  AVprotect9x.exe
  CMGRDIAN.EXE
  CMON016.EXE
  CPF9X206.EXE
  CPFNT206.EXE
  CV.EXE
  CWNB181.EXE
  CWNTDWMO.EXE
  ICSSUPPNT.EXE
  DEFWATCH.EXE
  DEPUTY.EXE
  DPF.EXE
  DPFSETUP.EXE
  DRWATSON.EXE
  ENT.EXE
  ESCANH95.EXE
  AVXQUAR.EXE
  ESCANHNT.EXE
  ESCANV95.EXE
  AVPUPD.EXE
  EXANTIVIRUS-CNET.EXE
  FAST.EXE
  FIREWALL.EXE
  FLOWPROTECTOR.EXE
  FP-WIN_TRIAL.EXE
  FRW.EXE
  FSAV.EXE
  AUTODOWN.EXE
  FSAV530STBYB.EXE
  FSAV530WTBYB.EXE
  FSAV95.EXE
  GBMENU.EXE
  GBPOLL.EXE
  GUARD.EXE
  GUARDDOG.EXE
  HACKTRACERSETUP.EXE
  HTLOG.EXE
  HWPE.EXE
  IAMAPP.EXE
  IAMAPP.EXE
  IAMSERV.EXE
  ICLOAD95.EXE
  ICLOADNT.EXE
  ICMON.EXE
  ICSUPP95.EXE
  ICSUPPNT.EXE
  IFW2000.EXE
  IPARMOR.EXE
  IRIS.EXE
  JAMMER.EXE
  ATUPDATER.EXE
  AUPDATE.EXE
  KAVLITE40ENG.EXE
  KAVPERS40ENG.EXE
  KERIO-PF-213-EN-WIN.EXE
  KERIO-WRL-421-EN-WIN.EXE
  BORG2.EXE
  BS120.EXE
  CDP.EXE
  CFGWIZ.EXE
  CFIADMIN.EXE
  CFIAUDIT.EXE
  AUTOUPDATE.EXE
  CFINET.EXE
  NAVAPW32.EXE
  NAVDX.EXE
  NAVSTUB.EXE
  NAVW32.EXE
  NC2000.EXE
  NCINST4.EXE
  AUTOTRACE.EXE
  NDD32.EXE
  NEOMONITOR.EXE
  NETARMOR.EXE
  NETINFO.EXE
  NETMON.EXE
  NETSCANPRO.EXE
  NETSPYHUNTER-1.2.EXE
  NETSTAT.EXE
  NISSERV.EXE
  NISUM.EXE
  CFIAUDIT.EXE
  LUCOMSERVER.EXE
  AGENTSVR.EXE
  ANTI-TROJAN.EXE
  ANTI-TROJAN.EXE
  ANTIVIRUS.EXE
  ANTS.EXE
  APIMONITOR.EXE
  APLICA32.EXE
  APVXDWIN.EXE
  ATCON.EXE
  ATGUARD.EXE
  ATRO55EN.EXE
  ATWATCH.EXE
  AVCONSOL.EXE
  AVGSERV9.EXE
  AVSYNMGR.EXE
  BD_PROFESSIONAL.EXE
  BIDEF.EXE
  BIDSERVER.EXE
  BIPCP.EXE
  BIPCPEVALSETUP.EXE
  BISP.EXE
  BLACKD.EXE
  BLACKICE.EXE
  BOOTWARN.EXE
  NWINST4.EXE
  NWTOOL16.EXE
  OSTRONET.EXE
  OUTPOSTINSTALL.EXE
  OUTPOSTPROINSTALL.EXE
  PADMIN.EXE
  PANIXK.EXE
  PAVPROXY.EXE
  DRWEBUPW.EXE
  PCC2002S902.EXE
  PCC2K_76_1436.EXE
  PCCIOMON.EXE
  PCDSETUP.EXE
  PCFWALLICON.EXE
  PCFWALLICON.EXE
  PCIP10117_0.EXE
  PDSETUP.EXE
  PERISCOPE.EXE
  PERSFW.EXE
  PF2.EXE
  AVLTMAIN.EXE
  PFWADMIN.EXE
  PINGSCAN.EXE
  PLATIN.EXE
  POPROXY.EXE
  POPSCAN.EXE
  PORTDETECTIVE.EXE
  PPINUPDT.EXE
  PPTBC.EXE
  PPVSTOP.EXE
  PROCEXPLORERV1.0.EXE
  PROPORT.EXE
  PROTECTX.EXE
  PSPF.EXE
  WGFE95.EXE
  WHOSWATCHINGME.EXE
  AVWUPD32.EXE
  NUPGRADE.EXE
  WHOSWATCHINGME.EXE
  WINRECON.EXE
  WNT.EXE
  WRADMIN.EXE
  WRCTRL.EXE
  WSBGATE.EXE
  WYVERNWORKSFIREWALL.EXE
  XPF202EN.EXE
  ZAPRO.EXE
  ZAPSETUP3001.EXE
  ZATUTOR.EXE
  CFINET32.EXE
  CLEAN.EXE
  CLEANER.EXE
  CLEANER3.EXE
  CLEANPC.EXE
  CMGRDIAN.EXE
  CMON016.EXE
  CPD.EXE
  CFGWIZ.EXE
  CFIADMIN.EXE
  PURGE.EXE
  PVIEW95.EXE
  QCONSOLE.EXE
  QSERVER.EXE
  RAV8WIN32ENG.EXE
  REGEDT32.EXE
  REGEDIT.EXE
  UPDATE.EXE
  RESCUE.EXE
  RESCUE32.EXE
  RRGUARD.EXE
  RSHELL.EXE
  RTVSCN95.EXE
  RULAUNCH.EXE
  SAFEWEB.EXE
  SBSERV.EXE
  SD.EXE
  SETUP_FLOWPROTECTOR_US.EXE
  SETUPVAMEEVAL.EXE
  SFC.EXE
  SGSSFW32.EXE
  SH.EXE
  SHELLSPYINSTALL.EXE
  SHN.EXE
  SMC.EXE
  SOFI.EXE
  SPF.EXE
  SPHINX.EXE
  SPYXX.EXE
  SS3EDIT.EXE
  ST2.EXE
  SUPFTRL.EXE
  LUALL.EXE
  SUPPORTER5.EXE
  SYMPROXYSVC.EXE
  SYSEDIT.EXE
  TASKMON.EXE
  TAUMON.EXE
  TAUSCAN.EXE
  TC.EXE
  TCA.EXE
  TCM.EXE
  TDS2-98.EXE
  TDS2-NT.EXE
  TDS-3.EXE
  TFAK5.EXE
  TGBOB.EXE
  TITANIN.EXE
  TITANINXP.EXE
  TRACERT.EXE
  TRJSCAN.EXE
  TRJSETUP.EXE
  TROJANTRAP3.EXE
  UNDOBOOT.EXE
  VBCMSERV.EXE
  VBCONS.EXE
  VBUST.EXE
  VBWIN9X.EXE
  VBWINNTW.EXE
  VCSETUP.EXE
  VFSETUP.EXE
  VIRUSMDPERSONALFIREWALL.EXE
  VNLAN300.EXE
  VNPC3000.EXE
  VPC42.EXE
  VPFW30S.EXE
  VPTRAY.EXE
  VSCENU6.02D30.EXE
  VSECOMR.EXE
  VSHWIN32.EXE
  VSISETUP.EXE
  VSMAIN.EXE
  VSMON.EXE
  VSSTAT.EXE
  VSWIN9XE.EXE
  VSWINNTSE.EXE
  VSWINPERSE.EXE
  W32DSM89.EXE
  W9X.EXE
  WATCHDOG.EXE
  WEBSCANX.EXE
  CFIAUDIT.EXE
  CFINET.EXE
  ICSUPP95.EXE
  MCUPDATE.EXE
  CFINET32.EXE
  CLEAN.EXE
  CLEANER.EXE
  LUINIT.EXE
  MCAGENT.EXE
  MCUPDATE.EXE
  MFW2EN.EXE
  MFWENG3.02D30.EXE
  MGUI.EXE
  MINILOG.EXE
  MOOLIVE.EXE
  MRFLUX.EXE
  MSCONFIG.EXE
  MSINFO32.EXE
  MSSMMC32.EXE
  MU0311AD.EXE
  NAV80TRY.EXE
  ZAUINST.EXE
  ZONALM2601.EXE
  ZONEALARM.EXE

It attempts to post information about the infected computer on the follwing websites:

• http://www.bmgs.bund.de
  http://www.gtz.de
  http://www.dwelle.de
  http://www.monster.de
  http://www.regtp.de
  http://www.stufenlos-regelbar.de
  http://www.rapz-records.de
  http://abtacha.wirebrain.de
  http://die-cliquee.de
  http://www.gantke-net.de
  http://www.dar-fantasy.de
  http://www.mdirk.de
  http://www.calistyler.de
  http://tripod.de
  http://sgi1.rz.rwth-aachen.de
  http://www.sysserver1.de
  http://www.vwschubert.de
  http://ronnyackermann.de
  http://www.destatis.de
  http://www.berlinonline.de
  http://www.meinestadt.de
  http://obechmann.de
  http://www.stepstone.de
  http://www.degruyter.de
  http://www.lufthansa.de
  http://www.duden.de
  http://www.pcwelt.de
  http://www.astronomie.de
  http://www.abacho.de
  http://www.bundesliga.de
  http://www.expo2000.de
  http://knecht.cs.uni-magdeburg.de
  http://www.murczak.de
  http://www.murczak.de
  http://www.lupo18t.de
  http://www.hosteurope.de
  http://login.rz.fh-augsburg.de
  http://www.hannobunz.de
  http://dfk-crew.clanintern.de
  http://www.empire-show.de
  http://www.atlantis-show.de
  http://www.superstar-nord.de
  http://www.lords-of-havoc.de
  http://deepiceman.de
  http://www.atlas-hannover.de
  http://begros.de
  http://www.h-p-i.de
  http://www.szakos.de
  http://www.king-alp.de
  http://people-ftp.freenet.de
  http://www.stuttgart.de
  http://www.eumetsat.de
  http://www.gutenberg2000.de
  http://www.heidelberg.de
  http://www.tu-muenchen.de
  http://www.studentenwerke.de
  http://www.stellenmarkt.de
  http://zille.cs.uni-magdeburg.de
  http://www.mupad.de
  http://www.gelbeseiten.de
  http://www.klug-suchen.de
  http://www.niedersachsen.de
  http://www.frankfurter-buchmesse.de
  http://www.freiburg.de
  http://www.messe-duesseldorf.de
  http://www.beck.de
  http://zeus05.de
  http://www.europarl.de
  http://www.onlinereviewguide.com
  http://www.krebsinformation.de
  http://www.brigitte.de
  http://www.webhits.de
  http://www.kabel1.de
  http://www.saarland.de
  http://www.renewables2004.de
  http://www.awi-bremerhaven.de
  http://www.uni-tuebingen.de
  http://www.frankfurt-airport.de
  http://people-ftp.freenet.de
  http://people-ftp.freenet.de
  http://www.szakos.de
  http://www.king-alp.de
  http://niematec.de
  http://symbit.de
  http://pe-data.de
  http://web154.essen082.server4free.de
  http://web216.berlin240.server4free.de
  http://edwinf.surfplanet.de
  http://www.stricker-doerpen.de
  http://www.helmholtz.de
  http://www.staedtetag.de
  http://www.tu-dresden.de
  http://www.immobilienscout24.de
  http://www.karlsruhe.de
  http://www.citypopulation.de
  http://www.schulen-ans-netz.de
  http://www.fernuni-hagen.de
  http://www.stifterverband.de
  http://www.wissenschaft-online.de
  http://www.nuernbergmesse.de
  http://www.dortmund.de
  http://www.uni-marburg.de
  http://www.anwaltverein.de
  http://www.math-net.de
  http://www.finanznachrichten.de
  http://www.uni-bremen.de
  http://www.tu-darmstadt.de
  http://www.aachen.de
  http://www.dasding.de
  http://www.messe-muenchen.de
  http://www.uni-duisburg-essen.de
  http://www.photokina.de
  http://www.umweltbundesamt.de
  http://www.jugendherberge.de
  http://www.bitburger.de
  http://www.munich-airport.de
  http://www.uni-mannheim.de
  http://www.uni-frankfurt.de
  http://www.ruhr-uni-bochum.de
  http://www.medicine-worldwide.de
  http://www.firstgate.de
  http://www.kompetenznetze.de
  http://www.uni-jena.de
  http://www.testdaf.de
  http://www.kalenderblatt.de
  http://www.baden-wuerttemberg.de
  http://www.saarbruecken.de
  http://www.kompetenzz.de
  http://www.aquarius.geomar.de
  http://www.uni-duesseldorf.de
  http://www.urlaubstage.de
  http://www.wiley-vch.de
  http://www.mohr.de
  http://www.bessy.de
  http://www.bayerninfo.de
  http://www.uni-osnabrueck.de
  http://www.stuttgarter-zeitung.de
  http://www.mathguide.de
  http://www.blk-bonn.de
  http://www.slowfood.de
  http://www.schaubuehne.de
  http://www.unibw-muenchen.de

The worm also attempts to delete:

• %SYSDIR%\re_file.exe

Removal instructions:

Let BitDefender delete all files found infected with this worm.

ANALYZED BY:

Patrick Vicol BitDefender Virus Researcher