Bagle.AZ Worm

Information about Bagle.az Worm:

                     Bagle.az worm spreads via e-mail and file sharing networks in Windows platform. It collects e-mail addresses stored in .xml, .xls, .wsh, .wab, .uin, .txt, .tbb, .stm, .shtm, .sht, .pl, .php, .oft, .ods, .nch, .msg, .mmf, .mht, .mdx, .mbx, .jsp, .htm, .eml, .dhtm, .dbx, .cgi, .cfg, .asp, and .adb files to send infected messages. The message body, subject and attachment name will be randomly chosen by the worm.

                     When the infected attachment is executed, the worm copies itself to Windows system folder as "sysformat.exe". The worm also creates new keys in the registry Run section to load automatically. The registry modification is given below.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
sysformat = C:\%SYSTEM%\sysformat.exe

                     Bagle.az worm searches C to Z drives and drops infected copy in the file sharing folders. This worm is appeared on January 26th 2004. 

Removing Bagle.az worm from your computer:

                     Fire has incorporated bagle.az worm in signature file to protect Fire users from this worm attack. Fire anti-virus users can update this signature file by using online update facility. It is available with the registered version of Fire anti-virus Kit.

                     A free download of FireLite [ 1100 KB ] version is also available to detect Mydoom Worm. If you find this worm, use registered version of Fire to remove. To get the registered version of Fire call us at 044-28170440 or mail to service@fireav.com

[Analysis: Mr.Jacob Kalis, Prognet Technologies Pvt. Ltd, Jan. 2005]