W32/Arman.D is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be Axaye Sexy Dokhtaraye Iran Zamin!.

The body of the infected mail will be the following;

Salam be tamamie baro bach inam ye collection bahal az tasavire sexy dokhtahaye iran zamin hast , halesho bebarid.

Upon execution, the worm displays a message box with the following message.

error loading dll
The installation has failed to start because _agl43.dll was not found. Re-installing the application may fix this problem.

It copies itself as [random characrters].exe in the Windows folder and Windows System folder.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run

This worm first appeared on November 10, 2005.

 Other names of W32/Arman.D Worm:

This Worm is also known as Email-Worm.Win32.Arman.d .