W32/Lecna.D Worm

 Information about the W32/Lecna.D Worm:

W32/Lecna.D is a worm. The worm will infect Windows systems and spreads through Network shares.

Upon execution, the worm copies itself as iexplore.exe in Program Files folder.

It also drops the netsvc.exe and netsvcs in Windows System folder and DriverNum.dat in Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

It tries to connect to the following websites and downloads a file.

www.flyeagles.com/restore/diz[REMOVED]
www.flyeagles.com/restore/hostl[REMOVED]
www.flyeagles.com/restore/conn[REMOVED]

It spreads through network shares by exploiting LSASS vulnerability present in Windows as explained by Microsoft Security Bulletin MS04-011.

You can check your system for other Windows Vulnerabilities using the Protector Plus - Windows Vulnerability Scanner. It guides you to update with the right patch to make your system secure.

You can download and learn more about Protector Plus - Windows Vulnerability Scanner at the following location:

http://www.pspl.com/download/winvulscan.htm

This worm first appeared on November 13, 2006.

 Other names of W32/Lecna.D Worm:

This Worm is also known as W32.Lecna.D.