This worm spreads via the Internet as an attachment to infected messages, and via shared network resources.
Characteristics of infected messages:
Message header, body and attachment name (with .pif extension) are chosen at random from predefined list.
The worm uses a direct connection to the SMTP-server to send messages.
The wom copies itself to the Windows directory under the name csrss.exe
and registers this file in the system registry auto-run key:
thus attempting to disguise itself as an antivirus working against Bagle.
Also, the worm attempts to delete registry keys created by I-Worm.Bagle.y
Use antivirus (also check How To Remove section)Startup Optimizer to delete this worm from your machine.