Sophos

W32/Stration-AP

Aliases
  • Email-Worm.Win32.Warezov.nf
  • Win32/Stration.YU
  • WORM_STRAT.IM
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Email messages
  • Network shares
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from July 2007 (4.19)
Protection available since 4 June 2007 19:55:44 (GMT)
Detected by All Sophos products

Action

More Information

W32/Stration-AP is a worm for the Windows platform.

W32/Stration-AP spreads via network shares and email messages.

W32/Stration-AP is a worm for the Windows platform.

W32/Stration-AP spreads via network shares and email messages.

When first run W32/Stration-AP creates the following files:

\hotpmsta.exe - also detected as W32/Stration-AP
\mprmdpnm.dll - also detected as W32/Stration-AP
\apcunetu.dll - also detected as W32/Stration-AP
\sclgcert.exe - detected as W32/Stratio-FU

\hotpmsta.dat - DAT file, may be deleted safely.

and appends itself to the following registry entry to start itself:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
mprmdpnm.dll

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer