Worm.Bagle.CP

Worm.Bagle.CP is a mass-mailing email worm that causes PC performance degradation and data loss. Worm.Bagle.CP allows attackers remote access to an infected computer system. Worm.Bagle.CP can also download and install other malware infections on an affected PC. Worm.Bagle.CP spreads via email, which carries a randomly named attachment with a .EXE extension. If PC users open an attachment, it will infect their computer system, start the innocuous calc.exe (Calculator) program, and change the registry to remain active upon computer restart. Worm.Bagle.CP examines .htm, .html, .wab and .txt files detected on a compromised PC system to steal email addresses in order to forward itself to other Internet users. Worm.Bagle.CP uses its own SMTP engine to send its email; therefore, copies of the malicious sent email will not occur in the mail client's 'Sent Items' folder. Worm.Bagle.CPalso tries to download and execute the Mitglieder, also known as Lohav Trojan, which functions as a proxy and tries to download more corrupt files from the Web.

Technical Details