Worm:Win32/Bagle.ZE@mm is a mass-mailing worm that attempts to download and run arbitrary files from remote Web sites. Worm:Win32/Bagle.ZE@mm collects e-mail addresses from the local drive and by checking remote Web sites referenced in the worm's code. The worm attempts to terminate the Windows Automatic Update service and modifies the registry in an attempt to disable booting into Safe Mode.

Worm:Win32/Bagle.ZE@mm contains several routines that run against the local computer, including:

• displaying a text file "error message" using Notepad

• dropping copies of itself

• gathering e-mail addresses

• spreading via e-mail

• downloading additional malicious programs

• terminating Windows Automatic Update service, and prevent booting into Safe Mode

Installation

• %AppData%\hidn\hidn2.exe
• %AppData%\hidn\hldrrr.exe

• Adds value: "FirstRun"
  With data: "1"
  To subkey: HKEY_CURRENT_USER\Software\
• Adds value: "drv_st_key"
  With data: %AppData%\hidn\hidn2.exe
  To subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

When this worm is first executed, it displays a fake "error message" using Notepad, which acts as a distraction while it performs its other routines. Bagle.ZE creates ERROR.TXT on the root of drive C:\. This text file contains a single line: "Text decoding error." It displays the contents of this file if a system check indicates this is the initial run of the worm:
   

Spreads Via…

E-mail

Modifies System Settings

Downloads and Executes Arbitrary Files

Worm:Win32/Bagle.ZE@mm attempts to connect to multiple remote Web sites in order to retrieve a file named "123.gif". This file may be a malicious executable, and when downloaded, the file may be saved to "<system>\re_file.exe", then executed. In some cases, the file is not malicious but is instead actually an image file: