W32/Foamer.A Worm

 Information about the W32/Foamer.A Worm:

W32/Foamer.A is a worm. The worm will infect Windows systems. The worm spreads through mapped network drives.

The worm may arrive as an attachment to a spammed email or as a dropped file from the network.

Upon execution of the infected attachment, the worm copies itself as svchost.exe and winnt.exe in the Windows folder and as explorer.exe in the Windows System folder.

It also copies moaphie.exe and autorun.inf in the root of mapped drives.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also modifies the following registry subkeys;

HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main
HKEY_CURRENT_USER\Software\Microsoft\Windows\Policies\system
HKEY_CURRENT_USER\Software\Microsoft\Windows\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\Policies\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

The worm attempts to download and execute files the following URLs;

http://www42.websamba.com/88xq2y/xxx_videos/maria_shara(Removed)
http://www42.websamba.com/88xq2y/xxx_videos/brithney_s(Removed)
http://www42.websamba.com/88xq2y/key_g(Removed)
http://www42.websamba.com/88xq2y/hack(Removed)
http://www42.websamba.com/88xq2y/msn85/ms(Removed)
http://www42.websamba.com/88xq2y/msn/msn_specia(Removed)
http://www42.websamba.com/88xq2y/Mon(Removed)

This worm first appeared on October 20, 2006.

 Other names of W32/Foamer.A Worm:

This Worm is also known as W32.Foamer.A.