W32/Sygyp.A Worm

 Information about the W32/Sygyp.A Worm:

W32/Sygyp.A is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be;

Google Earth - Explore, Search and Discover

The body of the infected mail will be;

Want to know more about a specific location? Dive right in -- Google Earth combines satellite
imagery, maps and the power of Google Search to put the world's geographic information at your
fingertips.

* Fly from space to your neighborhood. Type in an address and zoom right in.
* Search for schools, parks, restaurants, and hotels. Get driving directions.
* Tilt and rotate the view to see 3D terrain and buildings.
* Save and share your searches and favorites. Even add your own annotations.

The infected attachment will be;

GoogleEarthSetup.exe

Upon execution of the infected attachment, the worm copies itself as Regverif32.exe in Windows System folder and GoogleEarthSetup.exe in Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

php, htt, xls, htx, eml, sht, jsp, stm, htm, php, hta, doc, hte, xml, js, cgi, vbs and vb

The worm mails itself to these addresses using its own SMTP engine.

It tries to disable some of the security related software. It also blocks the acess to some of the security related websites.

This worm first appeared on January 22, 2006.

 Other names of W32/Sygyp.A Worm:

This Worm is also known as W32.Sygyp.A@mm.