What is it?
syslogin.exe is a file associated with the W32.Bagz@mm worm. What does it do?
W32.Bagz@mm is a mass-mailing worm that uses its own SMTP engine to
send itself to email addresses gathered from the infected computer.
When W32.Bagz@mm is executed, it does the following:
- Creates the following copy of itself:
%System% utorial.doc <spaces> .exe
Note: %System% is a variable that refers to the System folder.
By default this is C:WindowsSystem (Windows 95/98/Me),
C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows
- Adds the value:
"syslogin.exe" = "syslogin.exe"
to the registry key:
so that the worm is executed every time Windows starts.
- Creates the following files:
- Disables the Windows firewall.
- Downloads and executes remote files.
- Installs its own network driver to bypass local firewalls.