W32/Bagle.EA is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject and body of the infected mail will be in Russian language.

The name of the infected attachment will be any one of the following;

me.cab
new.cab
Re.cab
cool.cab
you.cab

Upon execution, the worm copies itself as ntsys.exe in Windows System folder and csrss.exe in Windows installation folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system.

xml, dbx, mbx, mdx, wab, txt, msg, htm, shtm, stm, nch, mmf, ods, tbb, sht, xls, cfg, asp, php, pl, wsh, adb, oft, uin, cgi, mht, dhtm and jsp.

It mails itself to these addresses using its own SMTP engine.

It also downloads updated copy from the following websites.

[http://]84.22.161.192/s/[removed]
[http://]207.46.250.119/g/[removed]
[http://]85.249.23.35/m2/[removed]

This worm first appeared on April 14, 2006.

 Other names of W32/Bagle.EA Worm: