9/3: Worm Ends Antivirus Processes
September 3, 2004

Bagle.AY is a worm that ends processes belonging to several antivirus update programs, among other applications.

Bagle.AY spreads via e-mail, in a message with an attached file with a random name and a ZIP extension. This file contains an HTML file, together with a hidden EXE file. This executable file is run when the user opens the HTML file.

Once it has affected the computer, Bagle.AY attempts to download a fake JPG file from several websites. If successful, Bagle.AY will start spreading from the computer.

Technical details are at Panda Software page.