Resolve for BagleDl-AA

Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms.

They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.

Troj/BagleDl-AA is a Trojan for the Windows platform.

Troj/BagleDl-AA attempts to terminate processes and services, delete files and registry entries, and block access to URLs related to anti-virus and security programs. Troj/BagleDl-AA is a Trojan for the Windows platform.

When first run Troj/BagleDl-AA copies itself to antiav_exe.exe and creates the file antiav_dll.dll. Both these files are detected as Troj/BagleDl-AA.

Troj/BagleDl-AA attempts to inject the dropped file antiav_dll.dll into the process explorer.exe.

The following registry entries are created to run antiav_exe.exe on startup:

HKCUSoftwareMicrosoftWindowsCurrentVersionRun auto__antiav__key antiav_exe.exe

HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun auto__antiav__key antiav_exe.exe

Troj/BagleDl-AA attempts to terminate several processes and services related to anti-virus and security programs, to delete related files, to modify C:boot.ini to delete related files on system startup, to block access to related websites, to delete related registry entries, and to delete registry entries at the following location to stop related files from running on system startup:

HKLMSOFTWAREMicrosoftWindowsCurrentVersion Run

HKCUSoftwareMicrosoftWindowsCurrentVersion Run

Troj/BagleDl-AA can be removed from Windows computers automatically with the following Resolve tools:

ENFALGUI is a disinfector for standalone Windows computers. To use it you have to do the following: ￭ Open ENFALGUI.com file from your desktop after downloading it. ￭ Click on the Start Scan Button. ￭ Wait for the process to complete.

BDLAASFX.EXE is a self-extracting archive containing BDLAACLI, a Resolve command line disinfector for use by system administrators on Windows networks.