Update on new worm

We have now analysed the new worm (see below) further. It’s actually a new variant of Atak – Email-Worm.Win32.Atak.h. Some variants of this family are similar to some of the Mydoom worms.

Atak.h copies itself to the Windows sytem directory as dec25.exe

It writes itself to win.ini to ensure that a copy of the worm is launched each time the victim machine is started.

[windows] run=file path dec25.exe

A full description will be available soon.

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *