W32.Moulo

Discussion in 'malware problems & news' started by Bowserman, Jun 20, 2003.

Thread Status:
Not open for further replies.
  1. Bowserman

    Bowserman Infrequent Poster

    Joined:
    Apr 15, 2003
    Posts:
    510
    Location:
    South Australia
    From Symantec: http://www.symantec.com/avcenter/

    "W32.Moulo is a worm that copies itself to the hard drive and the floppy disk drive. It uses the same icon as Microsoft Word and is written in Microsoft Visual Basic.

    Also Known As: W32/Mouseloco.Worm [Mcafee]
    Type: Worm
    Infection Length: 16,384 bytes
    Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
    Systems Not Affected: Macintosh, OS/2, UNIX, Linux


    When W32.Moulo is executed, it does the following:


    Copies itself as:
    %Windir%\WinCMI.exe
    A:\IUT-RC-chicas.exe


    Adds the value:

    "WinCMI"="%Windir%\WinCMI.exe"

    to the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "



    Regards, Jade ;).

    BTW, Is it alright that I post these so frequently?.......hope so :D.
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Warning the members of this community is always OK, Jade. :)
    As long as you keep the sticky post by UNICRON in this section in mind.

    Regards,

    Pieter
     
  3. Bowserman

    Bowserman Infrequent Poster

    Joined:
    Apr 15, 2003
    Posts:
    510
    Location:
    South Australia
    Thanks for the quick reply mate :).

    I had read UNICRON's sticky, and I think I am doing it right :D..........just thought I better check.

    Thanks Pieter.

    Regards, Jade.
     
Thread Status:
Not open for further replies.