W32/Bagle.BE is a mass mailing worm. This worm is a variant of W32/Bagle.A. The worm will infect Windows systems.

The worm arrives as a downloaded file of W32/Bagle.BE Trojan.

Upon execution of the infected attachment, the worm copies itself as windlhhl.exe in the Windows System folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ru1n
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ru1n

To propagate itself, the worm mass mails copies of W32/Bagle.BE Trojan to all the email addresses gathered from the files having the extension .wab on the infected system.

It also attempts to download a file from pre-defined website.

The worm also has a backdoor component that allows remote users to upload files to the Web server.

This worm first appeared on 1st March, 2005.

Other names of W32/Bagle.BE Worm:

This Worm is also known as WORM_BAGLE.BE, W32/Bagle.bn@MM, W32.Beagle.BG@mm.