Trend Micro Virus Alert - WORM_WURMARK.A

WORM_WURMARK.A is a non-destructive, memory resident worm that propagates by sending a copy of itself as an attachment to email messages, which it sends to target addresses using its own Simple Mail Transfer Protocol (SMTP) engine. This worm is currently spreading in-the-wild and infecting systems that run Windows 95, 98, ME, NT, 2000, XP, 2003.

This worm arrives as attachment of an email message. Upon execution, it drops a copy of itself in the Windows system folder using a random file name. It logs keystrokes and drops a dynamic link library (DLL) file that Trend Micro detects as TSPY_AGENT.C. It also modifies the registry to ensure its automatic execution at every Windows startup.

WORM_WURMARK.A gathers email addresses from the Temporary Internet Files folder, as well as from several files.

WORM_WURMARK.A has the following aliases: W32.Lanieca.B@mm, W32/Eyeveg.worm, Win32/Atak.Variant!Worm

If you would like to scan your computer for WORM_WURMARK.A, or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com/

WORM_WURMARK.A is detected and cleaned by Trend Micro pattern file #2.699.00 and above.