Resolve for BagleDl-AB

Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms.

They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.

Troj/BagleDl-AB is a Trojan for the Windows platform.

When first run Troj/BagleDl-AB copies itself to hloader_exe.exe and creates the file hleader_dll.dll. Both these files are detected as Troj/BagleDl-AB. Troj/BagleDl-AB is a Trojan for the Windows platform.

When first run Troj/BagleDl-AB copies itself to hloader_exe.exe and creates the file hleader_dll.dll. Both these files are detected as Troj/BagleDl-AB.

Troj/BagleDl-AB attempts to inject the dropped file hleader_dll.dll into the process explorer.exe.

The following registry entries are created to run hloader_exe.exe on startup:

HKCUSoftwareMicrosoftWindowsCurrentVersionRun auto__hloader__key hloader_exe.exe

HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun auto__hloader__key hloader_exe.exe

Troj/BagleDl-AB attempts to download and execute files from a number of remote websites.

Troj/BagleDl-AB can be removed from Windows computers automatically with the following Resolve tools:

BAGDLGUI is a disinfector for standalone Windows computers. To use it you have to do the following: ￭ Open BAGDLGUI.com file from your desktop after downloading it. ￭ Click on the Start Scan Button. ￭ Wait for the process to complete.

BAGDLSFX.EXE is a self-extracting archive containing BDLAACLI, a Resolve command line disinfector for use by system administrators on Windows networks.