W32/Bagle variants: The last three versions, F, G and H, use password protected zip files as extensions, with random numeric passwords. The passwords are appended into the body message of the infected email.
There's some additional info in the article, but for more specific info, check with your AV site.