W32/Stration.EL Worm

 Information about the W32/Stration.EL Worm:

W32/Stration.EL is a worm. This worm is a variant of W32/Stration.A. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The 'Subject' of the infected mail will be any one of the following;

Error
Mail Delivery System
Good day
Mail Delivery Error
Server Report
test
Mail Transaction Failed
Status
hello
picture

The body of the infected mail will be;

The message contains Unicode characters and has been sent as a binary attachment.

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment

Mail server report.
Our firewall determined the e-mails containing worm copies are being sent from your computer.
Nowadays it happens from many computers, because this is a new virus type (Network Worms).
Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself
to these e-mail addresses.
Please install updates for worm elminiation and your computer restoring.
Best regards,
Customers support services.

The received letter contained some errors. It is delivered as an attachment.
------
Mail server note.
Mail transaction failed. Partial message is available.

The name of the infected attachment will be any one of the following;

attach[Random digits]..txt.[blank spaces]exe.dat
doc.zip
Update-KB[Random digits]-x86.exe
attach[Random digits].zip
Update-KB[Random digits]-x86.zip

or any one of the following;

docs
file
body
message
doc
test
readme

The extension of the above-mentioned infected attachments will be any one of the following;

bat
cmd
exe
pif
scr
zip

Upon execution of the infected attachment, the worm copies itself as [10 random characters].exe in Windows System folder.

Displays a message box with the title Error and a message Unknown error.

It also attempts to connect to the following website to download a file;

http://www6.seruijingandeshijin[blocked]

The worm modifies registry at the following location to load itself during each startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also terminates some of the security related processes.

This worm first appeared on December 15, 2006.

 Other names of W32/Stration.EL Worm:

This Worm is also known as W32.Stration.EL@mm.