W32.Bagz - messages.zip

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Bagz

Sender:

Spoofed.

Subject:


[Fwd: Broken link]
big announcements
building maintenance
Cost Inquiry
Deactivation Notice
failure notice
find a solution with this customer
Fwd: Password
Fwd: Your Funds are Eligible for Withdrawal
Knowledge Base Article
Message recieved, please confirm
My funny stories
Need help pls
No Subject
Open Invoices
Order Approval
progress news
Questions
Re: Help Desk Registration
Re: payment
RE: quote request
RE: Re: A question
Re: User ID Update
referrences
Returned mail: see transcript for details
troubles are back again
units available
Webmail Invite
What is this ????
when should i call you?
WinXP
You have recieved an eCard!

Message:

***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***You are currently
unable to send emails.This may be a billing issue.Please call the
billing center.The # for the billing office is located in the
attachedcontact list for your convenience.***ATTENTION: YOUR EMAIL IS
NOT BEING DELIVERED!***
Hello,I resent this email as attachment becauseit was previously
blocked by your email filters.Please read the attachment and
respond.Thanks,User
Hello,I was in a hurry and I forgot to attach an importantdocument.
Please see attached.Best Regards,User
Hello,My PC crashed while I was sending that last email.I have
re-attached the document of yours that I discovered.Please read
attached document and respond ASAP.Sincerely,User
Hello,Sorry, I forgot to attach the new contact information.Please
view the attached (.pdf) contact sheet.Sincerely,User
Hello,What version of windows you are using?This last document I
received from you came out weird.Please see the attached word file and
resend the file to me.Many thanks,User
Hello,Your email was received.YOUR REPLY IS URGENT!Please view the
attached text file for instructions.Regards,User
Hello,Your email was sent in an INVALID format.To verify this email
was sent from you,simply open the attached email (.eml) fileand click
yes in the sender options box.Thank You,User
last request before refunding
***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***Hello,The previous
email you sent has been recognized as spam.This means your email was
not delivered to your friend or client.You must open the attached file
to receive more information.***YOUR MESSAGE HAS BEEN RECOGNIZED AS
SPAM***
***URGENT: SERVICE SHUTDOWN NOTICE***Due to your failure to comply
with our emailRules and Regulations, your email account has
beentemporarily suspended for 24 hours unless we are contacted
regardingthis situation.You must read the attached document for
furtherinstructions. Failure to comply will result in termination of
your account.Regards,Net Operator***URGENT: SERVICE SHUTDOWN NOTICE***

Attachment:


account.doc [spaces] .exe
account.zip
arch.doc [spaces] .exe
arch.zip
archive.doc [spaces] .exe
archive.zip
atach.doc [spaces] .exe
atach.zip
att.doc [spaces] .exe
att.zip
contact.doc [spaces] .exe
contact.zip
Ctutorial.doc [spaces] .exe
db.doc [spaces] .exe
db.zip
doc.doc [spaces] .exe
doc.zip
documents.doc [spaces] .exe
documents.zip
file.doc [spaces] .exe
file.zip
mail.doc [spaces] .exe
mail.zip
message.doc [spaces] .exe
message.zip
messages.doc [spaces] .exe
messages.zip
msg.doc [spaces] .exe
msg.zip
read.doc [spaces] .exe
read.zip
readme.doc [spaces] .exe
readme.zip
support.doc [spaces] .exe
support.zip
warning.doc [spaces] .exe
warning.zip

Comments: A mass-mailing worm that uses its own SMTP engine to send itself to email addressesgathered from the infected computer.

Symptoms:


 Adds the value: "syslogin.exe" = "syslogin.exe" to the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun so that
the worm is executed every time Windows starts. 
 Creates the following files: %System%dl.exe %System%syslogin.exe

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode or VGA mode.
Run a full system scan and delete all the files detected as W32.Bagz@mm.
Delete the value that was added to the registry.