W32/Bobax.AH is a mass mailing worm. This worm is a variant of W32/Bobax. The worm will infect Windows systems and spreads through email and networks.

This worm exploits PnP vulnerability present in Windows as explained by Microsoft Security Bulletin MS05-039.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

bush
secret
Cool
joke
funny
pics

The body of the infected mail will be any one of the following;

Hey,
Check this out :-)

Hey,
Remember this?

Hello,
Long time! Check this out!

Hey,
I was going through my album, and look what I found..

Saddam Hussein - Attempted Escape, Shot dead
Attached some pics that i found

Secret!

Testing

Osama Bin Laden Captured.
Attached some pics that i found

with any one of the following strings;

++ www.pandasoftware.com
++ Attachment: No Virus found
++ www.norman.com
++ Attachment: No Virus found
++ Norman AntiVirus - You are protected
++ Panda AntiVirus - You are protected
++ Attachment: No Virus found
++ F-Secure AntiVirus - You are protected
++ www.f-secure.com
++ Attachment: No Virus found
++ Norton AntiVirus - You are protected
+++ www.symantec.com

The infected attachment may carry any one of the following extension;

pif, exe, scr or zip

Upon execution of the infected attachment, the worm copies itself in random name with an .exe extension under the Windows System folder.

It also drops a file was[random number].tmp in the Windows Temp folder.

This worm tries to inject was[random number].tmp file into the processes starting with the following strings.

expl, serv and Winl

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Microsoft has released the patch for the MS05-039 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on August 30, 2005.

 Other names of W32/Bobax.AH Worm:

This Worm is also known as W32.Bobax.AH@mm.