W32/Bagle.EO Worm

 Information about the W32/Bagle.EO Worm:

W32/Bagle.EO is a mass mailing worm. The worm will infect Windows systems. The worm spreads through email and P2P software.

The subject and body of the infected mail will any one of the following;

Fax Message
Encrypted document
Changes..
Protected message
Forum notify
Re: Hello
Notification
Re: Document
RE: Incoming Msg
Re: Msg reply
Re: Hi
Re: Incoming Message
RE: Message Notify
Re: Thanks :)
RE: Protected message
Site changes
RE: Text message
Incoming message
Re: Thank you!
Re: Yahoo!
Update

The body of the infected mail will be any one of the following;

Attach tells everything.
Attached file tells everything.
Check attached file.
Check attached file for details.
Message is in attach
More info is in attach
Pay attention at the attach.
Here is the file.
Please, read the document.
Read the attach.
Please, have a look at the attached file.
See attach.
Try this.
See the attached file for details.
Your document is attached.
Your file is attached.

The infected attachment will be any one of the following;

Details.exe
Information.exe
Document.exe
Message.exe
Readme.exe
MoreInfo.exe
Sources.exe
Updates.exe
text_document.exe

Upon execution of the infected attachment, the worm copies itself as winhost.exe in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

adb, asp, cfg, cgi, dbx, dhtm, eml, htm, jsp, mbx, mdx, mht, mmf, msg, nch, ods, oft, php, pl, sht, shtm, stm, tbb, txt, uin, wab, wsh, xls and xml

It also spreads through P2P software by copying itself as any one of the following in the folders by name My shares or Shared Music.

Ahead Nero 7.exe
Doom3_nocd.exe
Adobe Photoshop 9 full.exe
12 year old Katia sucks and fucks me in lots of positions. (teen preteen anal cumshot sex young whore school lolita.avi.exe
Kaspersky Antivirus 5.0
HalfLife2_noCD.exe
Lolita porn.avi.exe
KAV 5.0
Matrix 3 Revolution English Subtitles.exe
Microsoft Office XP working Crack, Keygen.exe
Microsoft Office 2003 Crack, Working!.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Opera 8 New!.exe
Norton Antivirus, working Keygen.exe
nude lolita.jpg.exe
Porno pics arhive, xxx.exe
Porno, sex, oral, anal cool, awesome!!.exe
Porno Screensaver.scr
Serials.txt.exe
WinAmp 6 New!.exe
Windown Longhorn Beta Leak.exe
WinAmp 5 Pro Keygen Crack Update.exe
XXX hardcore images.exe
Windows Sourcecode update.doc.exe

The worm tries to terminate some of the security related processes.

This worm first appeared on May 09, 2006.

 Other names of W32/Bagle.EO Worm:

This Worm is also known as WORM_BAGLE.EO.