FrEn

E-mail Print

Balge fix, a fix to get rid of the virus bagle and all its variants
Written by Administrator  |  Friday, 18 September 2009 07:56
AddThis Social Bookmark Button
Alias Bagle's Alias from other Antivirus Editor

  • W32/Bagle.gen [McAfee]
  • PWS-Bluedit [McAfee]
  • Generic.dx [McAfee]
  • TROJ_BAGLE.OU [Trend Micro]
  • TROJ_BAGLE.AO [Trend Micro]
  • WORM_BAGLE.KO [Trend Micro]
  • Trojan.DL.VB.ACWT.Gen [PCTools]
  • Worm.Bagle.RR [PCTools]
  • Email-Worm.Bagle!sd5 [PCTools]
  • Email-Worm.Win32.Bagle.jo [Kaspersky Lab]
  • Trojan.Lodeight.C [Symantec]

Information Most of the time, the virus Bagle and its variants stopped Antivirus and blocks your connection if you try to open a web sites for downloading or scanning online, they even disable the Windows firewall and Internet Connection Sharing, stopping ALG, SharedAccess and wscsvc what makes your PC vulnerable.

The virus uses the network to spread, it operates the registry at most to be launched at each system startup. Fortunately he has not operated with partitions files autorun.inf to worsen the situation.

As you already know, this is not a single virus that deals here, but everything that is Bagle, there are a dozen, we will not give you the details of each feature of each alternative, but the main actions and parameters affected by the virus.


File

Most of the time, the virus Bagle put for files in the Windows system directory:

  • <System>\mdelk.exe
  • <System>\wintems.exe
  • <System>\IExplorer.dll .dbt
  • <System>\ansi.exe

Puts one file in the Windowws directory, as name of "fghrtuyjfghr.exe" most of the time

  • <Windows>\fghrtuyjfghr.exe

The virus creates folder named m in the AppData Directory and puts file flec006.exe in this directory

  • <AppData>\m\flec006.exe

Registry Creates registry entry:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • mule_st_key
    • <AppData>\m\flec006.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    • IESet
    • IExplorer.dll .dbt
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
    • IESet
    • IExplorer.dll .dbt
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • IESet
    • IExplorer.dll .dbt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dbt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DBTFILE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DBTFILE\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DBTFILE\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DBTFILE\shell\open\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center\Svc
  • HKEY_CURRENT_USER\Software\FirstRRRun
  • HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications
  • HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\TestProg
  • HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\TestProg\Settings

Creates Value registry entry:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
    • (Default) = fghrtuyjfghr.exe %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
    • (Default) = fghrtuyjfghr.exe %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
    • (Default) = fghrtuyjfghr.exe %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
    • (Default) = fghrtuyjfghr.exe %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dbt
    • (Default) = DBTFILE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DBTFILE\shell\open\command
    • (Default) = fghrtuyjfghr.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • IESet = IExplorer.dll .dbt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    • EnableLUA
    • 0x00000000
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center\Svc]
    • EnableLUA
    • 0x00000016
  • [HKEY_CURRENT_USER\Software\FirstRRRun]
    • First12Ru123n
    • 0x00000001

Delete Notepad parameters:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
    • (Default)
    • <System>\System32\NOTEPAD.EXE %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
    • (Default)
    • <System>\NOTEPAD.EXE %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
    • (Default)
    • <system32>\NOTEPAD.EXE %1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
    • (Default)
    • <system32>\NOTEPAD.EXE %1



WARNINGIt is preferable to download this patch and to decompress it on your desktop, to start your machine in safe mode and of launching the patch, always in safe mode.

Download
 

Add comment


Security code
Refresh

Related articles
Latest posts

  • Free malware removal tool for Guard Online

    Written by %s admin 10/10/2011
    Guard Online is a another rogue Antispyware from the OpenCloud and AV Guard Online familly, it's a malware that pretends to be an Antivirus. Guard Online conducts a fake scan of your system; you are…
    Read more...

  • Free malware removal tool to remove AV Guard Online

    Written by %s admin 05/10/2011
    AV Guard Online is a another rogue Antispyware from the OpenCloud familly, it's a malware that pretends to be an Antivirus. AV Guard Online conducts a fake scan of your system; you are warned by a…
    Read more...

  • Free removal tool to remove Security Guard 2012

    Written by %s admin 05/10/2011
    Security Guard 2012 is a another rogue Antispyware from the OpenCloud familly, it's a malware that pretends to be an Antivirus. Security Guard 2012 conducts a fake scan of your system; you are warned…
    Read more...

  • Free removal tool for Advanced PC Shield 2012

    Written by %s admin 01/10/2011
    Advanced PC Shield 2012 is a another rogue Antispyware, it's a malware that pretends to be an Antivirus. Advanced PC Shield 2012 conducts a fake scan of your system; you are warned by a fake alarm…
    Read more...

  • Security Sphere 2012 Free Removal Tool

    Written by %s admin 01/10/2011
    Security Sphere 2012 is another spyware from the Security Tool family. Security Sphere 2012 is not a legit program; it's a fake, a counterfeit. Security Sphere 2012 claims to fix your system, but…
    Read more...
.
Information | Contact

© All Rights Reserved. net-studio.org 2009