http://www.f-secure.com/v-descs/bagle_by.shtml http://www.f-secure.com/v-descs/bagle_cr.shtml

This variant has a different set if download URLs and it executes Notepad as a decoy.