W32/Bagle.EW Worm

 Information about the W32/Bagle.EW Worm:

W32/Bagle.EW is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be be any one of the following;

Love you with all my heart!
Come Be With Me, my Love!
My dream is coming true!
Will You Be My Valentine?
See you tonight!

The body of the infected mail will be any one of the following;

Love at the lips was touchAs sweet as I could bear;And once that seemed too much;I lived on airThat crossed me from sweet things,The flow of - was it muskFrom hidden grapevine springsDown hill at dusk?I had the swirl and acheFrom sprays of honeysuckleThat when they re gathered shakeDew on the knu

ckle.I craved strong sweets, but thoseSeemed strong when I was young;The petal of the roseIt was that stung.Now no joy but lacks saltThat is not dashed with painAnd weariness and fault;I crave the stainOf tears, the aftermarkOf almost too much love,The sweet of bitter barkAnd burning clove.When stiff and sore and scarredI take away my hand

From leaning on it hardIn grass and sand The hurt is not enough:I long for weight and strengthTo feel the earth as roughTo all my length.

A stranger came to the door at eve,And he spoke the bridegroom fair.He bore a green-white stick in his hand,And, for all burden, care.He asked with the eyes more than the lipsFor a shelter for the night,And he turned and looked at the road afarWithout a window light.The bridegroom came forth into the porch

With, "Let us look at the sky,And question what of the night to be,Stranger, you and I."The woodbine leaves littered the yard,The woodbine berries were blue,Autumn, yes, winter was in the wind;"Stranger, I wish I knew."Within, the bride in the dusk alone Bent over the open fire,Her face rose-red with the glowing coalAnd the thought of the heart's desire.The bridegroom looke

d at the weary road,Yet saw but her within,And wished her heart in a case of goldAnd pinned with a silver pin.The bridegroom thought it little to giveA dole of bread, a purse,A heartfelt prayer for the poor of God,Or for the rich a curse;But whether or not a man was askedTo mar the love of twoby harboring woe in the bridal house,The bridegroom wished he knew.

I woke up in a white roomwith white lace curtains.Snow covered landscape;I_m in Memphis for certainYesterday, it took over three hoursjust to travel the last twenty miles.But nothing is like my wife_s familyalways being greeted with smilesI was hoping for a White Christmas.You_d be surprise how simple I am.Be careful what you wish forGod may be listening to your plan.Most of the nation is coveredwith that dangerous and beautiful thingI am grateful for arriving safelyfor my wife_s happiness is everything.She wanted to see her family,her father, uncles and aunts.I ve kept her in Southwest Texas too long;this trip

I most willingly grant.So, here we are nowin a snowy southern wonderland.Waiting for Christmas dinner to come;a present only my wife can understand

The name of the infected attachment will be any one of the following;

love_me.exe
love_me_now.exe
Mplay.exe

Upon execution, the worm copies itself as lmovie.exe in Windows System folder.

It also drops lmovie.exeopen and lmovie.exeopenopen in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the following extensions and collects the available email addresses from the infected system;

sht, pl, mmf, cfg, dbx, cgi, asp, adb, dhtm, eml, htm, jsp, mbx, mht, mdx, msg, nch, ods, oft, php, shtm, stm, tbb, txt, uin, wab, wsh, xls and xml.

This worm first appeared on February 15, 2006.

 Other names of W32/Bagle.EW Worm:

This Worm is also known as WORM_BAGLE.EW .