F-Bagle

The F-Bagle utility will disinfects PC systems infected with the following Bagle worm variants: ￭ W32/Bagle.AL@mm ￭ W32/Bagle.AC ￭ W32/Bagle.AF@mm ￭ W32/Bagle.AH@mm ￭ W32/Bagle.AI@mm ￭ W32/Bagle.AN@mm ￭ W32/Bagle.AO@mm ￭ W32/Bagle.AT@mm ￭ W32/Bagle.AU@mm ￭ W32/Bagle.AV@mm ("test version") ￭ W32/Bagle.AX@mm ￭ W32/Bagle.AY@mm ￭ W32/Bagle.A@mm ￭ W32/Bagle.B@mm ￭ W32/Bagle.C@mm ￭ W32/Bagle.D@mm ￭ W32/Bagle.E@mm ￭ W32/Bagle.F@mm ￭ W32/Bagle.G@mm ￭ W32/Bagle.H@mm ￭ W32/Bagle.I@mm ￭ W32/Bagle.J@mm ￭ W32/Bagle.K@mm ￭ W32/Bagle.L@mm ￭ W32/Bagle.M@mm ￭ W32/Bagle.O@mm ￭ W32/Bagle.U@mm ￭ W32/Bagle.V@mm ￭ W32/Bagle.W@mm ￭ W32/Bagle.X@mm ￭ W32/Bagle.Y@mm ￭ W32/Bagle.Z@mm ￭ Email-Worm.Win32.Bagle.ba ￭ Email-Worm.Win32.Bagle.bb ￭ Email-Worm.Win32.Bagle.bc ￭ Email-Worm.Win32.Bagle.pac (1 variant)

Additionally this utility will remove the following Mitglieder proxy trojan variants that are dropped by Bagle worms: ￭ W32/Mitglieder.AA ￭ W32/Mitglieder.AJ ￭ W32/Mitglieder.AG ￭ W32/Mitglieder.AV ￭ W32/Mitglieder.S ￭ W32/Mitglieder.T

Please note that the utility does not disinfect Bagle.N, Bagle.Q, Bagle.P, Bagle.R, Bagle.S and Bagle.T variants because of the polymorphic nature of their viral component.

Disinfection procedure should be as follows: ￭ Unpack the F-Bagle utility from the provided ZIP archive ￭ Close all running applications and run the unpacked F-Bagle.exe file from a hard disk to eliminate the infection. You can run the utility by either doubleclicking on it from Windows Explorer or you can start it from a command interpreter (COMMAND.COM or CMD.EXE) by typing its name at command prompt and pressing 'Enter' (for advanced users). ￭ First the F-Bagle utility will kill Bagle worm's and Mitglieder trojan's processes in memory. Then the utility will remove Registry entries created by the worm. Finally the utility will scan all hard drives for infected files and delete them. ￭ Restart a computer. After restart your system should be clean.