W32/Bagle.BY Trojan

 Virus Information - W32/Bagle.BY Trojan:

W32/Bagle.BY is a downloader trojan. This will infect Windows systems.

The trojan arrives as an attachment along with an email in a compressed format .zip.   

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

The picture is sent on SMS
Is sent SMS

The body of the infected email will be blank.

The infected email carries any one of the following infected attachment;

beach.zip
In_park.zip
kitten.zip
legs.zip
new.zip
original.zip

Upon execution of the infected attachment, the trojan executes Mspaint application.
It copies itself as winshost.exe and wiwshost.exe in the Windows System folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The trojan also tries to terminate the processes related to some security softwares.

It also alters HOSTS file and prevents the user to access some of the security related websites.