Trend Micro Virus Alert - WORM_WURMARK.A

Discussion in 'malware problems & news' started by Randy_Bell, Jul 1, 2005.

Thread Status:
Not open for further replies.
  1. Randy_Bell

    Randy_Bell Registered Member

    May 24, 2002
    Santa Clara, CA
    WORM_WURMARK.A is a non-destructive, memory resident worm that propagates by sending a copy of itself as an attachment to email messages, which it sends to target addresses using its own Simple Mail Transfer Protocol (SMTP) engine. This worm is currently spreading in-the-wild and infecting systems that run Windows 95, 98, ME, NT, 2000, XP, 2003.

    This worm arrives as attachment of an email message. Upon execution, it drops a copy of itself in the Windows system folder using a random file name. It logs keystrokes and drops a dynamic link library (DLL) file that Trend Micro detects as TSPY_AGENT.C. It also modifies the registry to ensure its automatic execution at every Windows startup.

    WORM_WURMARK.A gathers email addresses from the Temporary Internet Files folder, as well as from several files.

    WORM_WURMARK.A has the following aliases: W32.Lanieca.B@mm, W32/Eyeveg.worm, Win32/Atak.Variant!Worm

    If you would like to scan your computer for WORM_WURMARK.A, or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at:

    WORM_WURMARK.A is detected and cleaned by Trend Micro pattern file #2.699.00 and above.
Thread Status:
Not open for further replies.