W32/Bagle.DL is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

February price
price

The body of the infected mail will be any one of the following;

February price
price

The infected attachment will be any one of the following;

price
February_price
pricelist
pricelst
new_price
price_lst
21_price
[random characters]

with any one of the following extensions.

.zip
.exe

Upon execution of the infected attachment, the worm copies itself as sysformat.exe in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It searches the network for shared folders with the shar and copies itself as any one of the following;

XXX hardcore images.exe
Windown Longhorn Beta Leak.exe
WinAmp 6 New!.exe
Opera 8 New!.exe
Matrix 3 Revolution English Subtitles.exe
WinAmp 5 Pro Keygen Crack Update.exe
Adobe Photoshop 9 full.exe
Ahead Nero 7.exe
8.exe
ACDSee 9.exe
9.exe
7.exe
6.exe
5.scr
4.exe
3.exe
2.exe
10.exe
1.exe

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

wab, txt, msg, htm, shtm, stm, xml, mdx, eml, dbx, mbx, nch, mmf, asp, ods, cfg, php, pl, adb, tbb, sht, wsh, xls, oft, cgi, mht, uin, dhtm and jsp.

It tries to terminate some of the security related processes.

This worm downloads a file from it's pre-configured list of websites and saves the downloaded file in Windows System folder.

This worm first appeared on February 22, 2006.

 Other names of W32/Bagle.DL Worm:

This Worm is also known as W32/Bagle-CY, W32.Beagle.DL@mm.