W32/Detnat.E is a virus. The virus will infect Windows systems.

Once activated this virus searches for C:\Recycled folder, if the folder does not exists it creates the folder.

If the folder already exists it checks for svch0st.exe in the folder, if the file does not exists it creates a copy of itself using the same file name. If the file already exists it will infect the file and executes the same.

It will remove its code from the original file from which it is executed, so the file from which the virus is executed will look like a clean file but the virus would have infected the computer already and will be running in the background.

The virus creates the event, Delphi to ensure that only one instance of the virus is running in memory.

It tries to connect to the following websites to download and excute a file.

http://[blocked]/Escrow/hana/LogIn/LogIn.wos
http://[blocked]/etc/Email/God/God.wos

This worm first appeared on June 07, 2006.

 Other names of W32/Detnat.E Virus:

This Worm is also known as PE_DETNAT.D.