F-Secure Virus Descriptions : Bagle.cr

Summary

This Bagle downloader appeared on Sep 9th, 2005. It is very similair to earlier Bagle variant Bagle.BY:

http://www.f-secure.com/v-descs/bagle_by.shtml

It has a different set if download URLs and instead of opening up mspaint.exe, it executes notepad.exe as a decoy.

Detection

F-Secure Anti-Virus detects this malware starting from the following update:

[FSAV_Database_Version]

Version=2005-09-09_02

Back to the Top

Technical Details: Jarkko Turkulainen, Sep 9th, 2005;

F-Secure Corporation