I-Worm.Bagle.as spreads via the Internet as an attachment to infected messages. It sends itself to all email addresses harvested from the victim computer. It contains a backdoor function.

The worm itself is a PE EXE file, 18758 bytes or greater in size.

Once launched, the worm copies itself to the Windows system directory under a variety of names:

Example:

C:\WINDOWS\SYSTEM32\bawindo.exe
C:\WINDOWS\SYSTEM32\bawindo.exeopen 
C:\WINDOWS\SYSTEM32\bawindo.exeopenopen

It then registers the appropriate file in the system registry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
bawindo = %system%\bawindo.exe

This ensures that the worm will launch each time the system is rebooted.

The worm searches for files with the following extensions:

adb
asp
cfg
cgi
dbx
dhtm
eml
htm
jsp
mbx

mdx
mht
mmf
msg
nch
ods
oft
php
pl
sht

shtm
stm
tbb
txt
uin
wab
wsh
xls
xml

and sends itself to all email addresses harvested from these files. It establishes a direct connection to the recipient's SMTP server in order to send messages.

Random

Re: 
Re: Hello
Re: Hi 
Re: Thank you! 
Re: Thanks :)

Joke
Price
price

with one of the following extensions:

com 
cpl 
exe
scr

The worm creates copies of itself in all subdirectories which contain the word 'Share' in their names. The copies are saved under names chosen from the following list:

ACDSee 9.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
Kaspersky Antivirus 5.0
KAV 5.0
Matrix 3 Revolution English Subtitles.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Opera 8 New!.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr
Porno, sex, oral, anal cool, awesome!!.exe
Serials.txt.exe
WinAmp 5 Pro Keygen Crack Update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
Windows Sourcecode update.doc.exe
XXX hardcore images.exe

The worm opens and tracks activity on TCP and UDP port 81 in order to receive commands.

I-Worm.Bagle.as