W32/Bagle.GY Worm

 Information about the W32/Bagle.GY Worm:

W32/Bagle.GY is a worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system

The subject of the infected mail will be blank.

The body of the infected mail will be any one of the following:

Ales
Andrew
Alice
Alyce
Androw
Anna
Androwe
Ann
Anne
Anthony
Annes
Anthonie
Anthonye
Bennet
Avice
Avis
Bennett
Constance
Christean
Christian
Cybil
Dorithie
Daniel
Danyell
Dorothee
Edmonde
Dorothy
Edmond
Edmund
Elizabeth
Edward
Edwarde
Elizabethe
Emanual
Ellen
Ellyn
Emanuel
Frances
Emanuell
Ester
Francis
Geoffraie
Fraunces
Gabriell
George
Harry
Grace
Happy New Year
Harrye
Henrye
Henrie
Henry
Hughe
Isabel
Humphrey
Humphrie
Isabell
Jeames
James
Jane
Jeffrey
Johen
Jeffrye
Joane
John
Judith
Josias
Judeth
Judithe
Leonard
Katherine
Katheryne
Leonarde
Margerie
Margaret
Margarett
Margerye
Marie
Margret
Margrett
Martha
Michael
Mary
Marye
Mychaell
Nathanyell
Nathaniel
Nathaniell
New 2006
Nicholas
New Year's
New Year's Day.
Nicholaus
Ralph
Nycholas
Peter
Rebecka
Robert
Richard
Richarde
Roberte
Rycharde
Roger
Rose
Samuell
Sindony
Sara
Sidney
Stephen
Suzanna
Susan
Susanna
Sybell
Thomas
Sybyll
Syndony
Valentyne
Winifred
We congratulate happy New Year
William
Wynefrede
Wynnefreede
Wynefreed

The infected attachment will be any one of the following;

Ales.zip
Andrew.zip
Alice.zip
Alyce.zip
Androw.zip
Anna.zip
Androwe.zip
Ann.zip
Anne.zip
Anthony.zip
Annes.zip
Anthonie.zip
Anthonye.zip
Bennet.zip
Avice.zip
Avis.zip
Bennett.zip
Constance.zip
Christean.zip
Christian.zip
Cybil.zip
Dorithie.zip
Daniel.zip
Danyell.zip
Dorothee.zip
Edmonde.zip
Dorothy.zip
Edmond.zip
Edmund.zip
Elizabeth.zip
Edward.zip
Edwarde.zip
Elizabethe.zip
Emanual.zip
Ellen.zip
Ellyn.zip
Emanuel.zip
Frances.zip
Emanuell.zip
Ester.zip
Francis.zip
Geoffraie.zip
Fraunces.zip
Gabriell.zip
George.zip
Harrye.zip
Grace.zip
Harry.zip
Henrie.zip
Hughe.zip
Henry.zip
Henrye.zip
Humphrey.zip
Isabell.zip
Humphrie.zip
Isabel.zip
James.zip
Jeffrey.zip
Jane.zip
Jeames.zip
Jeffrye.zip
John.zip
Joane.zip
Johen.zip
Josias.zip
Judithe.zip
Judeth.zip
Judith.zip
Katherine.zip
Leonarde.zip
Katheryne.zip
Leonard.zip
Margaret.zip
Margerye.zip
Margarett.zip
Margerie.zip
Margret.zip
Martha.zip
Margrett.zip
Marie.zip
Mary.zip
Mychaell.zip
Marye.zip
Michael.zip
Nathaniel.zip
Nicholas.zip
Nathaniell.zip
Nathanyell.zip
Nicholaus.zip
Ralph.zip
Nycholas.zip
Peter.zip
Rebecka.zip
Robert.zip
Richard.zip
Richarde.zip
Roberte.zip
Rycharde.zip
Roger.zip
Rose.zip
Samuell.zip
Sindony.zip
Sara.zip
Sidney.zip
Stephen.zip
Suzanna.zip
Susan.zip
Susanna.zip
Sybell.zip
Thomas.zip
Sybyll.zip
Syndony.zip
Valentyne.zip
Wynefrede.zip
William.zip
Winifred.zip
Wynefreed.zip
Wynnefreede.zip

Upon execution of the infected attachment, the worm copies itself as wind2ll2.exein the Windows system folder.

The worm creates the registry entries at the following location.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru1n
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ru1n

The worm tries to connect to the following websites and download a file.

http://[blocked]/1/w3eb.php
http://[blocked]/images/w3eb.php
http://[blocked]/help/w3eb.php
http://[blocked]/1/w3eb.php
http://[blocked]/1/w3eb.php
http://[blocked]/images/w3eb.php
http://[blocked]/1/w3eb.php
http://[blocked]/1/w3eb.php

It saves the downloaded file as eml.exe in Windows folder.

This worm first appeared on December 22, 2005.

 Other names of W32/Bagle.GY Worm:

This Worm is also known as WORM_BAGLE.GY .