Bagz.H
PeligrosidadDañoPropagación

Efectos 

Bagz.H realiza las siguientes acciones:

• Evita el acceso a los siguientes sitios web, que pertenecen en su mayoría a compañías antivirus y Microsoft:
  ad.doubleclick.net
  ad.fastclick.net
  ads.fastclick.net
  ar.atwola.com
  atdmt.com
  avp.ch
  avp.com
  avp.ru
  awaps.net
  banner.fastclick.net
  banners.fastclick.net
  ca.com
  click.atdmt.com
  clicks.atdmt.com
  dispatch.mcafee.com
  download.mcafee.com
  download.microsoft.com
  downloads.microsoft.com
  engine.awaps.net
  f-secure.com
  fastclick.net
  ftp.f-secure.com
  ftp.sophos.com
  go.microsoft.com
  liveupdate.symantec.com
  mast.mcafee.com
  mcafee.com
  media.fastclick.net
  msdn.microsoft.com
  my-etrust.com
  nai.com
  networkassociates.com
  office.microsoft.com
  phx.corporate-ir.net
  secure.nai.com
  securityresponse.symantec.com
  service1.symantec.com
  sophos.com
  spd.atdmt.com
  support.microsoft.com
  symantec.com
  update.symantec.com
  updates.symantec.com
  us.mcafee.com
  vil.nai.com
  viruslist.ru
  windowsupdate.microsoft.com
  www.avp.ch
  www.avp.com
  www.avp.ru
  www.awaps.net
  www.ca.com
  www.f-secure.com
  www.fastclick.net
  www.kaspersky.ru
  www.mcafee.com
  www.my-etrust.com
  www.nai.com
  www.networkassociates.com
  www.sophos.com
  www.symantec.com
  www.trendmicro.com
  www.viruslist.ru
  www3.ca.com
  Impidiendo el acceso a dichos sitios web, Bagz.H no permite actualizar los programas antivirus comercializados por dichas compañías, o descargar parches de seguridad de Windows.
  Esto deja al ordenador afectado indefenso frente a nuevo malware y vulnerabilidades.
• Borra las entradas del Registro de Windows que hagan referencia a cualquiera de los siguientes archivos, que pertenecen en su mayoría a programas antivirus y cortafuegos, entre otras herramientas de seguridad y de sistema:
  804mbd1.chk, 804mbd1.img, aboutplg.dll, alert.zap, appinit.ini, apwcmdnt.dll, apwutil.dll, ashavast.exe, ashbug.exe, ashchest.exe, ashdisp.exe, ashldres.dll, ashlogv.exe, ashmaisv.exe, ashpopwz.exe, ashquick.exe, ashserv.exe, ashsimpl.exe, ashskpcc.exe, ashskpck.exe, aswboot.exe, aswregsvr.exe, aswupdsv.exe, avcompbr.dll, avres.dll, bootwarn.exe, camupd.dll, ccavmail.dll, ccimscan.dll, ccimscn.exe, cerbprovider.pvx, cfgwiz.exe, cfgwzres.dll, defalert.dll, djsalert.dll, dunzip32.dll, edisk.dll, email.zap, emscnres.dll, filter.zap, firewall.zap, framewrk.dll, ftscnres.dll, idlock.zap, imscnbin.inf, imscnres.inf, ltchkres.dll, mcappins.exe, mcavtsub.dll, mcinfo.exe, mcmnhdlr.exe, mcscan32.dll, mcshield.dll, mcshield.exe, mcurial.dll, mcvsctl.dll, mcvsescn.exe, mcvsftsn.exe, mcvsmap.exe, mcvsrte.exe, mcvsscrp.dll, mcvsshl.dll, mcvsshld.exe, mcvsskt.dll, mcvsworm.dll, mghtml.exe, mpfagent.exe, mpfconsole.exe, mpfservice.exe, mpftray.exe, mpfui.dll, mpfupdchk.dll, mpfwizard.exe, mvtx.exe, n32call.dll, n32exclu.dll, naiann.dll, naievent.dll, navap32.dll, navapscr.dll, navapsvc.exe, navapw32.dll, navapw32.exe, navcfgwz.dll, navcomui.dll, naverror.dll, navevent.dll, navlcom.dll, navlnch.dll, navlogv.dll, navlucbk.dll, navntutl.dll, navoptrf.dll, navopts.dll, navprod.dll, navshext.dll, navstats.dll, navstub.exe, navtasks.dll, navtskwz.dll, navui.dll, navui.nsi, navuihtm.dll, navw32.exe, navwnt.exe, netbrext.dll, ntclient.dll, oeheur.dll, officeav.dll, opscan.exe, outscan.dll, outscres.dll, patch25d.dll, patchw32.dll, persfw.exe, pfwadmin.exe, probegse.dll, programs.zap, ptchinst.dll, qconres.dll, qconsole.exe, qspak32.dll, quar32.dll, quarantine, quaropts.dat, s32integ.dll, s32navo.dll, savrt.sys, savrt32.dll, savrtpel.sys, savscan.exe, scan.dat, scandlvr.dll, scandres.dll, scanmgr.dll, scanserv.dll, sched.exe, scriptui.dll, scrpres.dll, scrpsbin.inf, scrstres.inf, sdpck32i.dll, sdsnd32i.dll, sdsok32i.dll, sdstp32i.dll, security.zap, shextbin.inf, shextres.inf, shlres.dll, ssleay32.dll, statushp.dll, symnavo.dll, tutorwiz.dll, vsagntui.dll, vsavpro.dll, vsdb.dll, vsmon.exe, vsoui.dll, vsoupd.dll, vsowow.dll, vsruledb.dll, vsvault.dll, wormres.dll, zatutor.exe, zauninst.exe, zav.zap, zl_priv.htm, zlclient.exe, zlparser.dll y zonealarm.exe.
  
  Un efecto de esta acción es que estas aplicaciones no se ejecutarán automáticamente cada vez que Windows se inicie.

Metodo de Infección 

Bagz.H crea los siguientes archivos:

• SYSINFO32.EXE y TRACE32.EXE.
• IPDB.DLL, JOBDB.DLL y WDATE.DLL. Estos archivos son DLLs (Librería de Enlace Dinámico).
• Varias copias de sí mismo, que serán enviadas a través del correo electrónico.

Bagz.H modifica el archivo HOSTS, de modo que impide el acceso a determinados sitios web.

Bagz.H crea las siguientes entradas en el Registro de Windows:

• HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ Xuy v palto
  Service Name = Xuy v palto
• HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ Xuy v palto
  Display Name = Windows Secure SSL
• HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ Xuy v palto
  Description = This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service
• HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ Xuy v palto
  ExePath = %sysdir%\ trace32.exe
  donde %sysdir% es el directorio de sistema de Windows.
  Mediante estas entradas, Bagz.H se registra a sí mismo como un servicio de Windows.

Bagz.H borra las entradas del Registro de Windows que hagan referencia a archivos que pertenecen principalmente a programas antivirus y cortafuegos, tal y como se detalla en la sección Efectos.

Método de Propagación 

Bagz.H se propaga a través del correo electrónico. Para ello, realiza el siguiente proceso:

• Llega al ordenador en un mensaje de características variables, escrito en inglés:
  
  Asunto: es variable:
  Administrator
  Allert!
  Amirecans
  ASAP
  Att
  attach
  attachments
  best regards
  contract
  Have a nice day
  Hello
  Money
  office
  please responce
  re: Andrey
  re: order
  re: please
  Read this
  Russian's
  text
  toxic
  urgent
  Vasia
  waiting
  Warning
  
  Contenido: uno de los siguientes:
  Hello,
  Sorry, I forgot to attach the new contact information.
  Please view the attached (.pdf) contact sheet.
  Sincerely,
  User
  
  Hello,
  I resent this email as attachment because
  it was previously blocked by your email filters.
  Please read the attachment and respond.
  Thanks,User
  
  Hello,
  I was in a hurry and I forgot to attach an important
  document. Please see attached.
  Best Regards,
  User
  
  Hello,
  Your email was received.
  YOUR REPLY IS URGENT!
  Please view the attached text file for instructions.
  Regards,
  User
  
  Hello,
  Your email was sent in an INVALID format.
  To verify this email was sent from you,
  simply open the attached email (.eml) file
  and click yes in the sender options box.
  Thank You,
  User
  
  Hello,
  My PC crashed while I was sending that last email.
  I have re-attached the document of yours that I discovered.
  Please read attached document and respond ASAP.
  Sincerely,
  User
  
  Hello,
  What version of windows you are using?
  This last document I received from you came out weird.
  Please see the attached word file and resend the file to me.
  Many thanks,
  User
  
  ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
  Hello,
  The previous email you sent has been recognized as spam.
  This means your email was not delivered to your friend or client.
  You must open the attached file to receive more information.
  ***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
  
  ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
  ,
  You are currently unable to send emails.
  This may be a billing issue.
  Please call the billing center.
  The # for the billing office is located in the attached
  contact list for your convenience.
  ***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
  
  ***URGENT: SERVICE SHUTDOWN NOTICE***
  Due to your failure to comply with our email
  Rules and Regulations, your email account has been
  temporarily suspended for 24 hours unless we are contacted regarding
  this situation.
  You must read the attached document for further
  instructions. Failure to comply will result in termination of your account.
  Regards,
  Net Operator
  ***URGENT: SERVICE SHUTDOWN NOTICE***
  
  Hello
  Our contact information has changed.
  See the attached (.pdf) sheet for details.
  Sincerely,
  
  We have made recent updates to our database.
  Please verify your mailing address on file is correct.
  We have attached a (.pdf) sheet for you to use for your response.
  
  I have updated my email address
  See the (.pdf) file attached and
  please respond if you have any questions.
  
  My last email to you was returned.
  The reason is that I am not currently
  added to your "allowed" contact list.
  Please add my updated contact info
  provided in the attached (.pdf) file
  so I can send you emails in the future.
  Sincerely
  
  I apologize, but I need you to verify
  that I have the correct contact info for you.
  My system crashed last weekend and
  I lost most of my friends and work contacts.
  Please check the attached (.pdf) and
  please let me know if your info is current.
  
  I resent this email as attachment because
  it was previously blocked by your email filters.
  Please read the attachment and respond.
  Thanks
  
  This email is being sent as attachment because
  it was previously blocked by your email filters.
  Please view the attachment and respond.
  Thanks
  
  Can you please check out the email I have attached?
  For some reason, I received only part of your last several emails.
  I want to make sure that there are no problems with either of our accounts.
  
  I am responding to your last email in the attached file.
  I had a delivery problem with your inbox, so maybe you'll receive this now.
  
  Sorry to bother you, but I am having a problem receiving your emails.
  I am responding to your last email in the attached file.
  Please get back to me if there is any problem reading the attachment.
  
  Hi
  I was in a rush and I forgot to attach an important
  document. Please see attached doc file.
  Best Regards,
  
  Hi
  Sorry, I forgot to send an important
  document to you in that last email. I had an important phone call.
  Please checkout attached doc file when you have a moment.
  Best Regards
  
  Hi
  I was supposed to send you this document yesterday.
  Sorry for the delay, please forward this to your family if possible.
  It contains important info for both of you.
  
  Hi
  I made a mistake and forgot to click attach
  on the previous email I sent you. Please give me
  your opinion on this opportunity when you get a chance.
  Best Regards
  
  Hi
  Did you get the previous document I attached for you?
  I resent it in this email just in case, because I
  really need you to check it out asap.
  Best Regards
  
  Archivo adjunto: puede tener extensión doble, o estar comprimido en formato ZIP:
  ABOUT.DOC<varios espacios en blanco>.EXE, ADMIN.DOC<varios espacios en blanco>.EXE, ARCHIVATOR.DOC<varios espacios en blanco>.EXE, ARCHIVES.DOC<varios espacios en blanco>.EXE, ATACHES.DOC<varios espacios en blanco>.EXE, BACKUP.DOC<varios espacios en blanco>.EXE, DOCS.DOC<varios espacios en blanco>.EXE, DOCUMENTATION.DOC<varios espacios en blanco>.EXE, HELP.DOC<varios espacios en blanco>.EXE, INBOX.DOC<varios espacios en blanco>.EXE, MANUAL.DOC<varios espacios en blanco>.EXE, OUTBOX.DOC<varios espacios en blanco>.EXE, PAYMENT.DOC<varios espacios en blanco>.EXE, PHOTOS.DOC<varios espacios en blanco>.EXE, RAR.DOC<varios espacios en blanco>.EXE, README.DOC<varios espacios en blanco>.EXE, SAVE.DOC<varios espacios en blanco>.EXE, ZIP.DOC<varios espacios en blanco>.EXE, ABOUT.ZIP, ADMIN.ZIP, ARCHIVATOR.ZIP, ARCHIVES.ZIP, ATACHES.ZIP, BACKUP.ZIP, DOCS.ZIP, DOCUMENTATION.ZIP, HELP.ZIP, INBOX.ZIP, MANUAL.ZIP, OUTBOX.ZIP, PAYMENT.ZIP, PHOTOS.ZIP, RAR.ZIP, README.ZIP, SAVE.ZIP y ZIP.ZIP.
  
• El ordenador es afectado cuando se ejecuta el archivo adjunto.
• Bagz.H busca direcciones de correo electrónico en archivos con extensión DBX, HTM, TBB, TBI y TXT.
• Bagz.H envía una copia de sí mismo a todas las direcciones que ha recogido, exceptuando aquellas que contienen alguna de las siguientes cadenas de texto:
  @avp, @foo, @iana, @messagelab, @microsoft, abuse, admin, administrator@, all@, anyone@, bsd, bugs@, cafee, certific, certs@, contact@, contract@, feste, free-av, f-secur, gold-, gold-certs@, google, help@, hostmaster@, icrosoft, info@, kasp, linux, listserv, local, netadmin@, news, nobody@, noone@, noreply, ntivi, panda, pgp, postmaster@, rating@, root@, samples, sopho, spam, support, support@, unix, update, webmaster@, winrar y winzip.

Otros Detalles  

Bagz.H está escrito en el lenguaje de programación Visual C++. Este gusano tiene un tamaño de 166915 bytes, y está comprimido mediante UPX.