W32/Advegol Worm

 Information about the W32/Advegol Worm:

W32/Advegol is a worm. The worm will infect Windows systems and spreads through network shares and removable drives.

Upon execution, the worm copies itself as lsass.exe in the Windows System\Com folder.

It creates a mutex named "fdhglaiwcbhjfo" so that only one instance of the worm runs on the infected computer.

It then creates smss.exe in the Windows System\Com folder.

The worm attempts to terminate all the applications associated with any window that has any of the following strings in its title:

asm
ida
virus
process
ollydbg
softice
avp.tray
symantec
kaka_trayicon
regedit_regedit

The worm checks for all drives present on the infected computer and copies itself as [DRIVE_LETTER]:\pagefile.pif

It also creates [DRIVE_LETTER]:\AUTORUN.INF, which contains the instructions to start the worm when the drive is attached to a computer.

The worm also attempts to drop mm.gif to all the available network shares. This file contains a WMF file with an exploit to download a copy of the worm from http://www.123gold.cn/data(Blocked)

The worm scans all the local drives for files with an extension .exe and attempts to infect them with itself.

It also scans the local drives for files having the following extensions and attempts to infect them:

.asp
.htm
.jsp
.php
.spx
.tml

This worm first appeared on April 23, 2007.

 Other names of W32/Advegol Worm:

This Worm is also known as W32.Advegol.