Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Email-Worm:W32/Bagle.D


Aliases:


Email-Worm.Win32.Bagle.d

Malware
Email-Worm
W32

Summary

This type of worm is embedded in an e-mail attachment, and spreads using the infected computer's e-mailing networks.



Disinfection & Removal

For removal instructions specific to Bagle infections, see Email-Worm:W32/Bagle.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Email-Worm:W32/Bagle.D is very similar to Email-Worm:W32/Bagle.C, which was only released roughly 12 hours before this newer variant emerged.

There are very few differences in the C and D variants; they have the same sizes and same functionality, and the e-mails sent by them are identical. The major difference involves changes to the D variant to allow it to avoid detection by some antivirus programs.

Another, more minor change, involves a mutex installed by the worm to prevent it from installing on an already infected machine; Bagle.C uses the mutex name ""imain_mutex", whereas Bagle.D uses "iain_m2".

Bagle.D was found in the wild on February 28th, 2004







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.