Virus Profile: W32/Bagle.dv.dldr

Threat Search
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 2/15/2006
Date Added: 2/16/2006
Origin: Unknown
Length: N/A
Type: Trojan
Subtype: Downloader
DAT Required: 4698
Removal Instructions


This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Indication of Infection

W32/Bagle.dv.dldr attempts to download files from the following URLs:[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php[Removed]/mul.php

NOTE: At the time of writing this description, McAfee AVERT did not see the downloading of any files as they may have been moved or deleted at the remote site.

Methods of Infection

This downloader trojan is dropped by W32/Bagle.dv.dr that was mass spammed on February 15th, 2006.


TROJ_BAGLE.CW (Trend Micro), Trojan-Downloader.Win32.Bagle.y (Kaspersky), Win32/TrojanDownloader.Bagle.Z (ESET)

Virus Characteristics

W32/Bagle.dv.dldr is a trojan downloader that attempts to download and execute files from various compromised websites. As the website being communicated is normally controlled by the malware author, any files being downloaded can be remotely modified and the behavior of these new binaries altered - possibly with every user infection.

When executed, the trojan creates a copy of itself into the windows system directory


Adds the following values to the registry to auto start itself when Windows starts


"anti_troj" = "%WINDIR%\%SYSTEM%2\anti_troj.exe"

Adds the following registry key as a flag that indicates that the system is infected.

"FirstRun" = "01"


A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.



PC Infected? Get Expert Help

Virus Removal Service

Connect to one of our Security Experts by phone. Have your PC fixed remotely - while you watch!