W32/Bagle.OF is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected email will be any one of the following;

price
price [current date]
price_ [current date]
price-[current date]

The name of the infected attachment will be any one of the following;

new_price[current date].zip
latest_price[current date].zip

Upon execution, the worm copies itself as hidn2.exe and hldrrr.exe in Hidn folder which is created under the Current User's Application Data folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It also creates the following key as part of its installation routine:

HKEY_CURRENT_USER\SOFTWARE\FirstRuxzxpredefined

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

asp, cfg, adb, cgi, mdx, dhtm, eml, dbx, mmf, htm, mbx, jsp, mht, nch, msg, php, ods, pl, oft, sht, tbb, shtm, stm, txt, xls, wab, uin, wsh, xml.

The worm mails itself to these addresses using its own SMTP engine.

It may also download some possible malicious files from a list of predefined websites.

This worm first appeared on December 17, 2006.

 Other names of W32/Bagle.OF Worm:

This Worm is also known as WORM_BAGLE.OF.