W32/Sachy.A Worm

 Information about the W32/Sachy.A Worm:

W32/Sachy.A is a worm. The worm will infect Windows systems and spreads through network shares.

Upon execution, the worm creates the following files:

GO.bat, ftpdata.sys and VistA.bat in the Windows System\drivers folder
run.reg and smss.exe in the Windows System\ShellExt folder.

The worm attempts to connect to a FTP server on 135.fm260.com to download the following files to Windows System\ShellExt folder:

csrss.exe
yes.bat
wmi.vbs

The worm tries to delete ftpdata.sys, VistA.bat present in the Windows System\drivers folder and run.reg present in the Windows System\ShellExt folder.

The worm then scans the network for systems with TCP port 135 open. If found, the worm will attempt to login as Administrator using a blank password. Upon successful login it will attempt to launch a command prompt using WMI (Windows Management Instrumentation).

The worm tries to delete the following files, if present:

run.vbs, home.sys and nine.bat present in the Windows System\drivers folder.

The worm also connects to a FTP server on the Auto.Fm260.Com and attempts to download the following files:

toto.exe and smss.exe to the Windows System folder.

This worm first appeared on May 27, 2007.

 Other names of W32/Sachy.A Worm:

This Worm is also known as W32.Sachy.A.