W32/Bagle.X Trojan

 Information about the W32/Bagle.X Trojan:

W32/Bagle.X is proxy trojan. The worm will infect Windows systems.

Upon execution of the trojan it copies itself as WINDOW.EXE in Windows folder.
It alters the windows registry at the following location to load itself during next startup;

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Timeout

Once the trojan is installed onto the victim computer, it sends a  request to the hacker along with the critical information of the infected computer. The trojan attempts to connect to the following domain using a remote script;

http://bohe<Block this>.amillo.net/host.php
http://www.ab<Block this>86.net/host.php
http://ab<Block this>17.net/host.php

Once the connection is established the trojan works as a mail relay.

This trojan first appeared on April 8, 2004.

 Other names of W32/Bagle.X Trojan:

This Worm is also known as WORM_BAGLE.X, W32/bagle.x.worm, W32/Bagle.x!proxy.