W32/Jambu Worm

 Information about the W32/Jambu Worm:

W32/Jambu is a worm. The worm will infect Windows systems and spreads through removable storage devices and network shares.

Upon execution, the worm displays the following error message:

The movie cannot loaded because no Flash 8 Player found on your computer. Please installed first or go to www.macromedia.com to download latest Flash Player.

It then creates Flash Player.exe in the Windows\system folder, 6666.com, Flash_8_Player.exe and w32sys.exe in the Windows System folder.

It modifies the registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The worm also creates the following files on all drives, including mapped and removable drives:

(Empty).empty in the Documents and Settings\All Users\Start Menu\Programs\Startup folder,
Flash Games.exe in the Documents and Settings\All Users\Start Menu folder
AVRSYS.EXE in the Program Files\Common Files\Microsoft Shared\DAO folder
MSN.msn in the Program Files\Common Files\Microsoft Shared folder.

The worm may also create MESSAGE FROM HELL.HTML and FlashGame.exe in the root drive, AUTORUN.INF and Macromedia_Setup.exe in the Windows\Media folder.

This worm first appeared on April 19, 2007.

 Other names of W32/Jambu Worm:

This Worm is also known as W32.Jambu.