Today the Norman malware lab received a sample of a worm that changes the Windows password of the logged on user. Obviously, this can be quite annoying. However, this variant uses a static password : “H3H3H3”.
The worm was submitted from Indonesia, and is what is called an “autorun” worm – it copies itself to available drives and adds an autorun.inf file so as to be run automatically when f.ex. a removable drive is accessed. This is a quite common infection method.
File size : 327680 bytes
MD5 hash : e3ba28cf84a53a6ddd4f28f82acd0afe
File names used by the worm:
updater.exe
isass.exe
klmcodec568.exe
Additional files added:
change.vbs
autorun.inf
This worm will be detected as W32/PassChange.A by Norman's antivirus products using defs from today, Nov. 21. 2008 or later.
Add comment
If you find the content of this comment offensive, you can report it and our crew will have a look at it
Comments