W32/Deloader.A Worm

 Information about the W32/Deloader worm:

W32/Deloader.A is a network worm which also has trojan (backdoor), characteristics. This worm infects Windows systems and spreads through shared network drives.

When the worm is executed, it extracts and executes PSEXEC.EXE, which is a network utility that connects to remote machines in the network. It modifies the registry at the following location, to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It tries to connect to remote systems as an administrator, using a list of common passwords. It connects through port 445. If the connection is successful then it copies itself to the remote system's WINDOWS\SYSTEM folder as DVLDR32.EXE and executes the same. It also copies and executes a backdoor component called INST.EXE. The backdoor component allows the remote user to access the infected computer. This worm also tries to deny access to shared folders, in Windows XP and 2000 machines.

This worm first appeared on 9th March 2003.

 Other names of W32/Deloader.A worm:

This worm is also known as W32.HLLW.Deloder, WORM_DELODER.A, W32/Deloder-A