Home Malware Programs Worms Email-Worm.Win32.Bagle.fj

Email-Worm.Win32.Bagle.fj

Posted: March 9, 2011

Email-Worm.Win32.Bagle.fj is a worm and Trojan that prevents anti-malware programs from running, blocks security-related websites and drops other malware. The Email-Worm.Win32.Bagle.fj infection is noted to have an extremely high web presence along with Email-Worm.Win32.Bagle.fj's potentially severely-damaging attacks, and despite Email-Worm.Win32.Bagle.fj's age should still be considered a heavy PC threat. Rapidly removing Email-Worm.Win32.Bagle.fj is also important to prevent it from infecting other computers, since Email-Worm.Win32.Bagle.fj will harvest contacts from your PC to infect everyone you know, too.

Locking Your PC Down from Email-Worm.Win32.Bagle.fj's Influence

Being a worm, Email-Worm.Win32.Bagle.fj can spread from one computer to another very easily; common vectors of infection are removable drive devices and networks. Online, Email-Worm.Win32.Bagle.fj has several variations that are active on peer to peer file-sharing networks, but most Email-Worm.Win32.Bagle.fj infections use email to find new PCs to victimize.

Email-Worm.Win32.Bagle.fj looks for email contact-related information on any computer it infects and then sends itself as spam mail to all contacts. The message will have a random sender also chosen from harvested contacts, have 'price' as the subject line and 'February Price' as the body, and will include the worm's body in a semi-randomly named .zip attachment.

Infections of Email-Worm.Win32.Bagle.fj will also try to further infect Excel and Word application documents specifically. Finally, Email-Worm.Win32.Bagle.fj copies itself to folders containing the characters 'shar.' In the latter case, Email-Worm.Win32.Bagle.fj's copy will be an .exe file named after a popular program, keygen crack or pornographic content.

Email-Worm.Win32.Bagle.fj creates entries in the Windows Registry to run without user input required. Different anti-malware programs can detect Email-Worm.Win32.Bagle.fj as WORM_BAGLE.CL, W32/Bagle.dp!M328i, W32.Beagle.DL@mmi, W32/Bagle-CH or CME-328.

Indicators of Email-Worm.Win32.Bagle.fj Wrapped around Your PC

Symptoms of Email-Worm.Win32.Bagle.fj infection are typical of malware, but nonetheless still highly dangerous:

  • Email-Worm.Win32.Bagle.fj prevents you from running known security programs, with a special focus on the firewall and malware-removal applications.
  • Email-Worm.Win32.Bagle.fj alters your system's web-browsing settings to block you from visiting websites related to malware solutions or other computer security topics
  • .

  • Email-Worm.Win32.Bagle.fj may drop other malware onto the computer like a Trojan infection. This can let a remote attacker control your PC or cause an infinite variety of other problems related to viruses, rogue security applications etc.

Protection from Email-Worm.Win32.Bagle.fj has been around since 2006, but this worm remains widespread and dangerous to any computer. If you find yourself infected, using designated anti-malware programs is suggested. Email-Worm.Win32.Bagle.fj will hide in the Windows system folder in most cases, making an erroneous file deletion due to human error potentially disastrous for your operating system.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\random.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "RANDOM CHARACTERS"HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0470-17D4-8D9B-444578542000}HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
Loading...