high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 26 October 2006 06:18:53 (GMT) |
| Last updated | 22 April 2007 20:18:50 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Stratio-BG is a worm for the Windows platform.
When run W32/Stratio-BG copies itself to <Windows>\mswiz32.exe and creates the following files:
<System>\e1.dll - detected as W32/Stratio-BG
<Windows>\mswiz32.s - this file can be safely deleted
<Windows>\mswiz32.dat - this file can be safely deleted
<Windows>\mswiz32.wax - this file can be safely deleted
W32/Stratio-BG includes functionality to access the internet and communicate with a remote server via HTTP.
Once installed W32/Stratio-BG attempts to download a file from a remote website and run it. The downloaded file is detected as W32/Stratio-BG.
When run the downloaded file then creates the following files:
<System>\avifipxr.dll - detected as W32/Stratio-BG
<System>\icmpdx3j.dll - detected as W32/Stratio-BG
<System>\wshnseri.exe - detected as W32/Stratio-BG
<System>\e1.dll - detected as W32/Stratio-BG
The following registry entries are created to run W32/Stratio-BG on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mswiz32
<Windows>\mswiz32.exe s
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<random characters>
<System>\<random characters>.exe
The following registry entries are created to run icmpdx3j.dll and e1.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
icmpdx3j.dll e1.dll
|
