W32/Golten Worm

 Information about the W32/Golten Worm:

W32/Golten is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be:

Latest News about Arafat !!!

The body of the infected mail will be:

Hello Guys,

Latest News about Arafat!

Unimaginable!!!!!!

The mail contains two attachments arafat_1.emf and arafat_2.emf which installs the worm on vulnerable systems.

The worm attempts to spread via the admin share, connecting to remote system via existing reference or attempting to use weak administrator passwords.

Upon execution, the worm copies itself as Alerter.exe, sptres.dll, spc.exe(backdoor), SPO0LSV.EXE.
It also installs comwsock.dll, SCardSer.exe, mst.tlb, inetcfg.h, dmsock.dll via the backdoor spc.exe.

The worm also creates a service netlog. It injects the dmsock.dll file into one of the following running processes:

msnmsgr.exe
lsass.exe
msmsgs.exe
outlook.exe
svchost.exe
explorer.exe
iexplore.exe
inetinfo.exe
qq.exe
msimn.exe

This worm spreads via network shares. It also drops several files, including sptres.dll, which it injects into the EXPLORER.EXE process.

This worm first appeared on 12th November, 2004.

 Other names of W32/Golten Worm:

This Worm is also known as WORM_GOLTEN.A, W32/Aler.A.worm, W32.Scard, BackDoor-CJV .