Virus Database

I-Worm.Bagle.ao

Description I-Worm.Bagle.ao

This worm spreads via the Internet as an attachment to infected emails, and also via file-sharing networks.
It is almost identical to I-Worm.Bagle.an
It is compressed using PEX; the compressed file is 174924 bytes in size, and the uncompressed file is 23556 bytes in size.
Propagation via email
Infected messages:
Message header:
photo
Message body:
photo
The message body appears as an HTML page.
Attachment name:
foto.zip
fotos.zip
The attached archive is 4558 bytes in size.
Attachment contents:
foto.html 1calc.exe
The first file contains Exploit.CodeBaseExec
The second file contains TrojanDropper.Win32.Small.kv, which installs TrojanDownloader.Win32.Agent.cj on the victim machine. This program then downloads the main module of the worm.
Other
File names, registry key values, remote administration functions and the routine for propagating via file-sharing networks are identical to those of I-Worm.Bagle.an
The worm is programmed to cease functioning and to delete itself after 2nd September 2004.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Mun

Description Macro.Word.Mun

This is quite short Word macro virus. It contains only one macro: in documents - AutoOpen, in NORMAL.DOT - AutoClose. It infects the global macros area on opening an infected document and infects other documents on closing. The virus does not manifest itself in any way.

Macro.Word.Munch

Description Macro.Word.Munch

This is quite a small Word macro virus. It contains two macros: in documents - AutoOpen, macro1, in NORMAL.DOT - AutoOpen, macro10. It infects global macros area or documents on opening. The virus does not manifest itself in any way.

Home