W32/Bobax Worm

 Information about the W32/Bobax Worm:

W32/Bobax is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail may vary.

The body of the infected mail will be any one of the following;

Attached some pics that i found
Check this out :-)
Hello,
I was going through my album, and look what I found..
Long time! Check this out!
Osama Bin Laden Captured.
Remember this?
Saddam Hussein - Attempted Escape, Shot dead
Secret!
Testing

with any one of the following strings.

+++ Attachment: No Virus found
+++ Norman AntiVirus - You are protected
+++ F-Secure AntiVirus - You are protected
+++ Panda AntiVirus - You are protected
+++ Norton AntiVirus - You are protected
+++ www.norman.com
+++ www.f-secure.com
+++ www.symantec.com
+++ www.pandasoftware.com

The infected attachment will be any one of the following;

bush.1.zip
funny.1.zip
joke.1.zip
pics.1.zip
secret.2.zip

Upon execution of the infected attachment, the worm copies itself in random name with an .exe extension under the Windows System folder.

It also drops a file with .dll extension in a random name under the Windows Temp folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

To propagate itself, the worm gathers email addresses from the Windows Address Book and Windows Messenger Contact list of the infected system.

The worm mails a infected file detected as W32/Small.AXR to these addresses using its own SMTP engine.

This worm first appeared on June 3, 2005.

 Other names of W32/Bobax Worm:

This Worm is also known as W32.Bobax.Z, WORM_BOBAX.P.