W32/Bobandy.B is a mass mailing worm. The worm will infect Windows systems. The worm spreads through email and P2P networks.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

hello
Registration Confirmation
RE:bla bla bla
Cek This
RE:HeLLO GuYs

The body of the infected mail will be any one of the following;

please read again what i have written to you
For security reasons attached file is password protected.
The password is 55132098

hi please see this file
For security reasons attached file is password protected.
The password is 55132098

free screen saver romance for you
Please Visit Our Web Site
For security reasons attached file is password protected.
The password is 55132098

hey Indonesian porn
Tiara lestari pic's
For security reasons attached file is password protected.
The password is 55132098

thank's for you register, your acount details are attached
For security reasons attached file is password protected.
The password is 55132098

The name of the infected attachment will be any one of the following;

ZIPPED.zip
MYpIC.zip
USE_RAR_To_Extract.ace
4TITTA'S Picture.jar
curriculum vittae.zip

Upon execution of the infected attachment, the worm copies itself as;

o(random numbers)z\Tux(random characters).exe
o(random numbers)z\service.exe
o(random numbers)z\winlogon.exe
in the (User Account)\Templates folder.

Tita.exe
m\EmangEloh.exe
m\JabLay.com
m\smss.exe
sa-.exe
in the Windows folder.

(random numbers)l.exe
X(random numbers)go\Zcie.cmd
in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

To propagate itself, the worm collects all the available email addresses from the infected system and mails itself to these addresses using its own SMTP engine.

This worm first appeared on August 10, 2006.

 Other names of W32/Bobandy.B Worm: