W32/Bobandy is a mass mailing worm. The worm will infect Windows systems. The worm spreads through email and KaZaA P2P software.

It also spreads by copying itself to local folders and network drives.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be:

please read again what i have written to you
Agnes Monica pic's
Fucking With Me :D
foto dan data Wanita tsb Thank's
hey Indonesian porn
miss Indonesian
Aku Mencari Wanita yang aku Cintai
CoolMan

The body of the infected mail will be blank.

The name of the infected attachment will be any one of the following:

need you 6243883.zip
Doc 4166354.zip
video 9534116.zip
need you 6381956.zip

Upon execution of the infected attachment, the worm copies itself as lsass.exe, QSF7N0S.exe, VDM2H2G.exe, cypreg.dll, MoonLight.txt in Windows folder and MSWINSCK.ocx531, (random characters).exe, systear.dll, msvbvm60.dl in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

To propagate itself, the worm collects all the available email addresses from the Windows address book (WAB) of the infected system.

The worm attempts to terminate some of the security related processes.

This worm first appeared on March 21, 2007.

 Other names of W32/Bobandy Worm:

This Worm is also known as W32/Bobandy-I.