bagle
F-Bagle 1.00.12
Removal tool that will detect and remove Bagle worm variants from your computer more>> Removal tool that will detect and remove Bagle worm variants from your computer
The F-Bagle utility will disinfects PC systems infected with the following Bagle worm variants:
- W32/Bagle.AL@mm
- W32/Bagle.AC
- W32/Bagle.AF@mm
- W32/Bagle.AH@mm
- W32/Bagle.AI@mm
- W32/Bagle.AN@mm
- W32/Bagle.AO@mm
- W32/Bagle.AT@mm
- W32/Bagle.AU@mm
- W32/Bagle.AV@mm ("test version")
- W32/Bagle.AX@mm
- W32/Bagle.AY@mm
- W32/Bagle.A@mm
- W32/Bagle.B@mm
- W32/Bagle.C@mm
- W32/Bagle.D@mm
- W32/Bagle.E@mm
- W32/Bagle.F@mm
- W32/Bagle.G@mm
- W32/Bagle.H@mm
- W32/Bagle.I@mm
- W32/Bagle.J@mm
- W32/Bagle.K@mm
- W32/Bagle.L@mm
- W32/Bagle.M@mm
- W32/Bagle.O@mm
- W32/Bagle.U@mm
- W32/Bagle.V@mm
- W32/Bagle.W@mm
- W32/Bagle.X@mm
- W32/Bagle.Y@mm
- W32/Bagle.Z@mm
- Email-Worm.Win32.Bagle.ba
- Email-Worm.Win32.Bagle.bb
- Email-Worm.Win32.Bagle.bc
- Email-Worm.Win32.Bagle.pac (1 variant)
Additionally this utility will remove the following Mitglieder proxy trojan variants that are dropped by Bagle worms:
- W32/Mitglieder.AA
- W32/Mitglieder.AJ
- W32/Mitglieder.AG
- W32/Mitglieder.AV
- W32/Mitglieder.S
- W32/Mitglieder.T
Please note that the utility does not disinfect Bagle.N, Bagle.Q, Bagle.P, Bagle.R, Bagle.S and Bagle.T variants because of the polymorphic nature of their viral component.
Disinfection procedure should be as follows:
- Unpack the F-Bagle utility from the provided ZIP archive
- Close all running applications and run the unpacked F-Bagle.exe file from a hard disk to eliminate the infection. You can run the utility by either doubleclicking on it from Windows Explorer or you can start it from a command interpreter (COMMAND.COM or CMD.EXE) by typing its name at command prompt and pressing Enter (for advanced users).
- First the F-Bagle utility will kill Bagle worms and Mitglieder trojans processes in memory. Then the utility will remove Registry entries created by the worm. Finally the utility will scan all hard drives for infected files and delete them.
- Restart a computer. After restart your system should be clean.
Bagle.B Remover 3.5.1.11
This utility erases the Bagle.B virus from your PC more>> This utility erases the Bagle.B virus from your PC
Bagle.B is a worm that spreads via e-mail in a message with the subject ID ... thanks, and an attached file that has the same icon as a WAV audio file.
Bagle.B attempts to connect to several web pages that host a PHP script. By doing this, Bagle.B notifies its author that the affected computer can be accessed through the port 8866.
This worm only runs if the system date is February 25, 2004 or previous. After this date, Bagle.B stops functioning.
In case your computer is infected, the Bagle.B Remover will help you get rid of the virus in no time.
Bagle.E Remover 3.5.1.11
A useful tool for cleaning the Bagle.E virus from your computer more>> A useful tool for cleaning the Bagle.E virus from your computer
Bagle.E is a worm that spreads via e-mail in a message with variable characteristics, and an attached file that has an icon similar to the one belonging to Windows Notepad.
Bagle.E contains a backdoor, which opens the TCP port 2745. It attempts to connect to several web pages that host a PHP script. By doing this, Bagle.E notifies its author that the affected computer can be accessed through the port mentioned above.
In addition, Bagle.E ends the processes belonging to several antivirus update applications.
This worm only runs if the system date is March 14, 2004 or previous. After this date, Bagle.E stops functioning.
The Bagle.E Remover will enable you to easily get rid of the virus infection from your PC.
Bagle.C Remover 3.5.1.11
A useful tool for cleaning the Bagle.C virus from your computer more>> A useful tool for cleaning the Bagle.C virus from your computer
Bagle.C is a worm that spreads via e-mail in a message with variable characteristics, and an attached file that has the same icon as an Excel spreadsheet.
Bagle.C contains a backdoor, which opens the TCP port 2745. It attempts to connect to several web pages that host a PHP script. By doing this, Bagle.C notifies its author that the affected computer can be accessed through the port mentioned above.
In addition, Bagle.C ends the processes belonging to several antivirus update applications.
This worm only runs if the system date is March 14, 2004 or previous. After this date, Bagle.C stops functioning.
The Bagle.C Remover will allow you to easily erase the virus infection from your PC.
Bagle.A Remover 3.5.1.11
Clean the Bagle.A virus from your computer with this utility more>> Clean the Bagle.A virus from your computer with this utility
Bagle.A is a worm without destructive effects that spreads via e-mail in a message with the subject Hi and an attached file with a name that consists of several random characters and has an EXE extension.
Bagle.A runs only if the system date is January 28, 2004 or previous.
Bagle.A attempts to connect to several web pages through the port 6777, in order to update itself and make an inventory of the affected users. However, these web pages have been disabled. In addition, it has code that allows it to download files from the Internet and run them on the affected computer.
The Bagle.A Remover will enable you to get rid of the worm virus infection in no time.
Bagle.AA Remover 3.5.1.11
This utility erases the Bagle.AA virus from an infected PC. more>> This utility erases the Bagle.AA virus from an infected PC.
Bagle.AA is a worm that spreads via e-mail in a message with variable characteristics, and through peer-to-peer (P2P) file sharing programs.
Bagle.AA ends processes belonging to antivirus and firewalls programs, among other security applications, as well as to several worms.
In addition, it attempts to connect to several websites that host an PHP script through the port 2535. By doing so, Bagle.AA notifies its author that the computer has been affected.
With the Bagle.AA Remover youll be able to instantly clean the virus from your computer.
Bagle.BK Remover 3.5.1.11
A useful tool for cleaning the Bagle.BK virus from your PC more>> A useful tool for cleaning the Bagle.BK virus from your PC
Bagle.BK is a worm that has an expiration date of April 25, 2006. After this date, the worm will automatically stop its execution when it activates.
Bagle.BK ends processes belonging to antivirus programs and firewalls, among others. This leaves the affected computer vulnerable to the attack of other malware.
It also deletes the entries in the Windows Registry belonging to several variants of the worm Netsky.
Bagle.BK spreads via e-mail in a message with variable characteristics and through peer-to-peer (P2P) file sharing programs.
The Bagle.BK Remover will enable you to ge trid of the virus infection in no time!
Bagle.AH Remover 3.5.1.11
A useful tool for cleaning the Bagle.AH virus from your PC more>> A useful tool for cleaning the Bagle.AH virus from your PC
Bagle.AH is a worm that affects Windows XP/2000/NT computers only. Bagle.AH opens and listens to a TCP port, waiting for remote connections. By doing so, it allows hackers to gain remote control over the affected computer in order to carry out malicious actions that would compromise users confidentiality or impede normal work.
Bagle.AH ends processes belonging to antivirus programs and firewalls, among others. This leaves the affected computer vulnerable to the attack of other malware.
Additionally, this worm connects to several web pages that contain a PHP script.
It also eliminates the entries in the Windows Registry belonging to several variants of the worm Netsky.
Bagle.AH spreads via e-mail in a message with variable characteristics and through peer-to-peer file sharing programs (P2P).
With the Bagle.AH Remover youll be able to easily get rid of the virus infection.
Bagle.AI Worm Cleaner 1.0.0.0
Easily remove the Win32.Bagle worm from an infected computer more>> Easily remove the Win32.Bagle worm from an infected computer
The Bagle.AI Worm Cleaner detects and cleans a computer infected by Win32.Bagle worm. Rebooting your computer may be necessary after the cleaning process bas been completed.
<<lessBagle.BA-BB Worm Cleaner 1.0.0.0
Remove Bagle virus variants from your computer with just a few clicks more>> Remove Bagle virus variants from your computer with just a few clicks
The Bagle.BA-BB Worm Cleaner detects and cleans a computer infected by the Win.32.Bagle worm. When the cleaning process has been completed, restarting your PC may be necessary.
Variants detected and removed by the cleaner:
- Win32.Bagle.BA
- Win32.Bagle.BB
- Win32.Bagle.BI
Remover for I-Worm.Bagle.gen 2.3.0.7
A tool which removes I-Worm.Bagle.gen more>> A tool which removes I-Worm.Bagle.gen
This virus removal tool was designed to help users disinfect their computers when infected with I-Worm.Bagle.gen. (I-Worm.Bagle.A-Q,U)
<<lessWin32.Bagle.AD@mm Removal Tool 1.0
Free Win32.Bagle.AD@mm Removal Tool more>>
- When run, the virus displays a fake message, stating: "Cant find a viewer associated with the file"
- Presence of the next files in %SYSTEM% folder:
loader_name.exe
loader_name.exeopen
loader_name.exeopenopen
- Presence of the next registry key or entry:
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] "reg_key"="%SYSTEM%loader_name.exe"
where %WINDOWS% points to Windows folder (or WinNT on Windows NT based systems) %SYSTEM% points to "System" folder on Windows 9x systems and "System32" folder on WinNT systems.
- Presence of files named:
Microsoft Office 2003 Crack, Working!.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Microsoft Office XP working Crack, Keygen.exe
Porno, sex, oral, anal cool, awesome!!.exe
Porno Screensaver.scr
Serials.txt.exe
KAV 5.0
Kaspersky Antivirus 5.0
Porno pics arhive, xxx.exe
Windows Sourcecode update.doc.exe
Ahead Nero 7.exe
Windown Longhorn Beta Leak.exe
Opera 8 New!.exe
XXX hardcore images.exe
WinAmp 6 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
Adobe Photoshop 9 full.exe
Matrix 3 Revolution English Subtitles.exe
ACDSee 9.exe
in folders whose names contain the string "shar"
Technical description: The virus arrives via e-mail
If the attachment is in a password protected zip file, following messages can also be found in the Body:
For security reasons attached file is password protected. The password is ...
For security purposes the attached file is password protected. Password -- ...
Note: Use password ... to open archive.
Attached file is protected with the password for security reasons. Password is ...
In order to read the attach you have to use the following password: ...
Archive password: ...
Password - ...
Password: ...
Win32.Bagle.AJ@mm Free Removal tool 1.0
Win32.Bagle.AJ@mm Free Removal tool more>>
Symptoms:
The presence of the following files in %SYSDIR% folder:
Winxp.exe
Winxp.exeopen
Winxp.exeopenopen
Winxp.exeopenopenopen
Winxp.exeopenopenopenopen
The presence of the following registry key:
HKCUSoftwareMicrosoftWindowsCurrentVersionRunkey with value %SYSDIR%winxp.exe
where %SYSDIR% is a variable representing the system folder (for example: C:WINDOWSSYSTEM)
Aliases: WORM_BAGLE.AH (TREND) W32/Bagle-AI (Sophos) W32/Bagle.AG@mm (SARC)
Bagle A-K/U-V/AB-AH Worm Cleaner 1.0.0.2
Easily remove the Win32.Bagle worm from your computer more>> Easily remove the Win32.Bagle worm from your computer
Bagle A-K/U-V/AB-AH Worm Cleaner detects and cleans a computer infected by the Win32.Bagle worm. Rebooting your system may be necessary after the cleaning process has been completed.
<<lessWin32.Bagle.AL@mm free removal tool 1.0
Free removal tool for Win32.Bagle.AL@mm more>>
- Presence of file %SYSTEM%WINdirect.exe.
- Presence of file %SYSTEM%windll.exe.
- Presence of registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunwin_upd.exe = %SYSTEM%WINdirect.exe or
HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunwin_upd.exe = %SYSTEM%WINdirect.exe.
- Presence of registry key HKCUSOFTWAREMicrosoftWindowsCurrentVersionRu1n.
Technical description:
The worm comes in the form of a small file, that drops another file ( namely WINDirect.exe) in the %SYSTEM% directory.
This file then tries to raise its privilege level and then starts a thread in which it keeps looking at all the processes and when it finds one within a list ( in order to prevent updating an AV product or the use of a firewall ) it tries to terminate it. Then it starts another thread that tries to download the main part of the massmailer from a list of addresses, each 10 hours.
