Worm:Win32/Bagle.BA@mm!CME477

Presence of a file named text.exe in %windir%.

Presence of a file named winhost.exe in <system folder>, the Windows system folder.
Note: The <system folder> default path is as follows:
On Windows XP/Server 2003 -- C:\Windows\System32
On Windows NT/2000 -- C:\Winnt\System32
On Windows 95/98/ME -- C:\Windows\System

Presence of any of the following files in any folder having a name that includes the string "shar":
Ahead Nero 7.exe
hardcore arhive.exe
important update.exe
important.exe
install.exe
Kaspersky Antivirus 5.0
message.msg<spaces>.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
New document.doc<spaces>.exe
New patch.exe
patch.exe
Porno pics arhive, xxx.exe
Porno Screensaver.scr',0
Porno, sex, oral, anal cool, awesome!!.exe
Serials.txt<spaces>.exe
setup.exe
text.txt<spaces>.exe
update.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
Windows Sourcecode update.doc<spaces>.exe
XXX hardcore images.exe