W32/Bagle.CY is an email worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be blank.

The body of the infected mail will be any one of the following;

new price
Password:
price
The password is

The name of the infected attachment will be any one of the following;

price_new.zip
new__price.zip
new_price.zip
Newprice.zip
09_price.zip
price.zip
price2.zip
price_09.zip

These compressed files contains a copy of W32/Bagle.CY Trojan.

Upon execution of the infected attachment the worm copies windll2.exe in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ru1n
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ru1n

This worm first appeared on September 19, 2005.

 Other names of W32/Bagle.CY Worm:

This Worm is also known as WORM_BAGLE.DA.