• Home
• >Threat Encyclopaedia
• >Descriptions
• > Win32/Wapomi.K

Short description

Win32/Wapomi.K is a file infector. The virus tries to download and execute several files from the Internet.

Installation

When executed, the virus creates the following files:

A string with variable content is used instead of %random% .

Installs the following system drivers:

The following services are disabled:

The virus attempts to replace the following files with a copy of itself:

The following Registry entries are created:

The virus may set the following Registry entries:

A string with variable content is used instead of %variable1-3% .

Instead of %servicename% , the value(s) are taken from the following Registry entry:

File infection

Win32/Wapomi.K is a file infector.

The virus infects .exe files including .exe files in RAR archives.

It also infects files stored on removable and network drives.

It avoids files which contain any of the following strings in their path:

Files are infected by adding a new section that contains the virus .

The host file is modified in a way that causes the virus to be executed prior to running the original code.

The size of the inserted code is 91949 B .

Spreading on removable media

The virus copies itself to the following location:

The virus creates the following file:

The AUTORUN.INF file contains the path to the malware executable.

Thus, the virus ensures it is started each time infected media is inserted into the computer.

Spreading via shared folders

The virus searches for various shared folders.

It tries to place a copy of itself into the folders.

The following usernames are used:

The following passwords are used:

The following filename is used:

A string with variable content is used instead of %variable% .

The virus schedules a task that causes the following file to be executed repeatedly:

Other information

It uses techniques common for rootkits.

The virus hides its presence in the system.

The following programs are terminated:

The following Registry entries are set:

The modified Registry entries will prevent specific files from being executed.

Win32/Wapomi.K is a virus which tries to download other malware from the Internet.

The virus acquires data and commands from a remote computer or the Internet.

The virus contains a list of (37) URLs. It tries to download several files from the addresses. The HTTP protocol is used.

The downloaded files contain encrypted executables.

After decryption, the virus runs these files.

The virus modifies the following file:

The virus may perform DoS attacks.

Win32/Wapomi.K is a virus that spreads by exploiting a vulnerability in Server Service .

If successful, the remote computer may attempt to download the copy of the virus from the Internet. This vulnerability is described in CVE-2008-4250 .

The virus opens the following URLs in Internet Explorer :

• Contact |
• Privacy |
• Legal Information |
• Sitemap