What
is the Beagle.A worm?
Beagle.A is a mass-mailing worm that accesses
remote Web sites and sends email to any addresses
it finds using its own SMTP engine.
Also
known as: I-Worm.Bagle, WORM_BAGLE.A, W32/Bagle-A,
W32/Bagle@MM, Win32.Bagle.A
How
Does the Beagle.A Worm Infect My Computer?
When Beagle.A is executed, it performs the
following actions:
- Checks if the system date is later than
January 28, 2004. If so, the worm will not do
anything.
- Inserts the file, %System%\bbeagle.exe.
- Launches the Windows Calculator, calc.exe.
- Adds the value:
"d3dupdate.exe" =
"%system%\bbeagle.exe"
to the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Adds the values:
- "uid" = "[Random
Value]"
- "frun" = "1"
to the registry key:
HKEY_CURRENT_USER\Software\Windows98
- Scans the system for files with the
extensions .wab, .txt, .htm, and .html, looks
for email addresses within these files, and
then emails itself to the addresses using its
own SMTP engine.
The worm attempts to use the local DNS server
to obtain the MX record for the recipient
address' SMTP. If the local DNS server is
unavailable, the worm uses a hard-coded server
to obtain the MX record.
- Creates a listening thread on port 6777 that
allows a remote attacker to:
- Execute commands on the local system as
if the attacker was the current user.
- Download executables onto the local
system.
- Terminate and delete the worm program.
- Creates a notification thread that will
contact a remote Web site (using local browser
proxy settings) and announce the presence of
the worm on the local system every 10 minutes.
The list of contacted Web sites is
predetermined, and the body of the worm
contains it.
How to Remove the Beagle.A Worm?
Kaspersky Internet Security Can Prevent You From Virus and Intrusion.
If Kaspersky detects Beagle.A during the
scan, it will AUTOMATICALLY offer you the option
of deleting it. Do this by following the
program's instructions.
Follow these steps
in removing the Beagle.A worm.
1. Disabling System Restore (Windows Me/XP)
For instructions on how to turn off System
Restore, read your Windows documentation, or one
of the following articles: "How
to disable or enable Windows Me/XP System Restore".
2. Terminating the Running Program
- Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, and click the Processes tab.
- In the list of running programs*, locate the
process:
bbeagle.exe
- Select the malware process, then press
either the End Task or the End Process button,
depending on the version of Windows on your
system.
- To check if the malware process has been
terminated, close Task Manager, and then open
it again.
- Close Task Manager.
3. Removing Autostart Entries from the
Registry
- Open Registry Editor. To do this, click
Start>Run, type Regedit, then press Enter.
- In the left panel, double-click the
following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Run
- In the right panel, locate and delete the
entry or entries:
d3dupdate.exe = "%System%\bbeagle.exe"
Note: %System% is the Windows system
folder, which is usually C:\Windows\System on
Windows 95, 98 and ME, C:\WINNT\System32 on
Windows NT and 2000, and C:\Windows\System32
on Windows XP.
- In the left panel, double-click the
following:
HKEY_USERS>%SystemInfo%>Software>Microsoft>Windows>
CurrentVersion>Run
- In the right panel, locate and delete the
entry or entries:
d3dupdate.exe = "%System%\bbeagle.exe"
Note: %SystemInfo% refers to a system
information, such as a Class ID or Username.
4. Removing Other Malware Registry Entries
The following are instructions to remove other
malware entries from the registry.
- Still in the Registry Editor, in the menu
bar click Edit>Find, and type "Uid" in
the text field, then click Find Next.
- When you come upon a value contained in a
registry key resembling the following, delete
the value:
HKEY_USERS\%SystemInfo%\Software\Windows98
- In the menu bar click Edit>Find, and type
"frun" in the text field then click Find
Next.
- When you come upon a value contained in a
registry key resembling the following, delete
the value:
HKEY_USERS\%SystemInfo%\Software\Windows98
- Close Registry Editor.
6. Updating the virus definitions
If you do not know which anti-virus software
can provide strong protection for you, Kaspersky Internet Security is recommended.
7. Run a full system scan and delete all the
files detected as Beagle.A.
- Start your Kaspersky Internet Security and make sure that it is
configured to scan all the files.
- Run a full system scan.
- If any files are detected as infected with
Beagle.A, click Delete.
How to Disinfect My Computer from Worms?
In order to keep your computer protected, bear
the following tips in mind:
- If you have filtering tools installed,
configure them to reject messages with the
characteristics described above. If, in spite
of doing this, you receive the message that
contains the virus: do not open it, do not run
the attached file and delete it, making sure
that you also delete it from the Deleted
Items folder.
- Install a good antivirus in your computer.
Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
- Keep your antivirus updated. If automatic
updates are available, configure your
antivirus to use them.
- Keep your permanent antivirus protection
enabled at all times.
Detect and Removal Instruction for Other
Variants:
|
