Computer Support Group and Services
LAMONT-DOHERTY EARTH OBSERVATORY
THE EARTH INSTITUTE AT COLUMBIA UNIVERSITY
Computer Support Group and Services
LDEO Home
IT Home
Search Site


W32.Beagle.AG@mm is a mass-mailing worm that uses its own SMTP engine to spread through email and opens a backdoor on TCP port 1080.

The subject line, body, and attachment name of the email vary. The attachment will have a .com, .cpl, .exe, .scr, or .zip file extension. If the file attachment is a .zip file, it will be password protected.

The worm is packed with PeX.

Removal Procedure

1. Download the FxBeagle.exe file from: Fix Beagle.
2. Save the file to a convenient location, such as your downloads folder or the Windows desktop, or removable media known to be
uninfected.
3. To check the authenticity of the digital signature, refer to the "Digital signature" section later in this writeup.
4. Close all the running programs before running the tool.
5. If you are on a network or if you have a full-time connection to the Internet, disconnect the computer from the network and the
Internet.
6. If you are running Windows Me or XP, then disable System Restore.Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details.*

Caution*:* *If you are running Windows Me/XP, we strongly
recommend that you do not skip this step.
7. Double-click the FxBeagle.exe file to start the removal tool.
8. Click Start to begin the process, and then allow the tool to run.
9. Restart the computer.
10. Run the removal tool again to ensure that the system is clean.
11. If you are running Windows Me/XP, then reenable System Restore.
12. Run LiveUpdate to make sure that you are using the most current virus definitions.


*Note*: The removal procedure may not be successful if Windows Me/XP System Restore is not disabled as previously directed, because Windows prevents outside programs from modifying System Restore.

When the tool has finished running, you will see a message indicating whether the computer was infected by W32.Beagle@mm. In the case of a removal of the worm, the program displays the following results:

* Total number of the scanned files
* Number of deleted files
* Number of repaired files
* Number of terminated viral processes
* Number of fixed registry entries

LDEO home | Support(request@ldeo.columbia.edu) | Webmaster | terms-of-use | support LDEO
Copyright © 2003 by The Trustees of Columbia University in the City of New York, Lamont-Doherty Earth Observatory.
All rights reserved.