What is it?
bawindo.exe is a file associated with the W32.Beagle.AR@mm mass-mailing worm
What does it do?
W32.Beagle.AR@mm is a mass-mailing worm that uses its own SMTP engine
to spread. The email attachment is a downloader, similar to the
Mitglieder family of Trojans, that downloads the worm from an external
source.
When the w32.Beagle.AR@mm worm is executed it:
Creates the following files:
%System%awindo.exe.
%System%awindo.exeopen
%System%awindo.exeopenopen
%System%
e_file.exe
Adds a value:
"bawindo"="%System%awindo.exe" to the registry key: HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
deletes some registry values from the registry keys:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunAttempts
to create copies of itself in any folder that contains the characters
"shar". The files will have the following file names:
- Microsoft Office 2003 Crack, Working!.exe
- Microsoft Windows XP, WinXP Crack, working Keygen.exe
- Microsoft Office XP working Crack, Keygen.exe
- Porno, sex, oral, anal cool, awesome!!.exe
- Porno Screensaver.scr
- Serials.txt.exe
- KAV 5.0
- Kaspersky Antivirus 5.0
- Porno pics arhive, xxx.exe
- Windows Sourcecode update.doc.exe
- Ahead Nero 7.exe
- Windown Longhorn Beta Leak.exe
- Opera 8 New!.exe
- XXX hardcore images.exe
- WinAmp 6 New!.exe
- WinAmp 5 Pro Keygen Crack Update.exe
- Adobe Photoshop 9 full.exe
- Matrix 3 Revolution English Subtitles.exe
- ACDSee 9.exe
More info and Removal @symantec
