W32/Degnax is a worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any of the following;

Fw: ASAP!!
Re: Look it now
For All..
ASAP!!
Detail...
Fw: Response Urgent..
Fantastic
In This Area
Follow Up
Global Area
Opening soon
Fw: Date Urgent
Your Friend
Fw: List Off
Time Line
Fw: other project
See detail
Fw: why ??
Re:So you
Fw: your advice
Morning!
Fw:My Offer
Gift today
Just Info..
I'm waiting
Next Step
I hope
List Off
I Hope
Important!!
Look it now
Re: Soon!
Joint?
Thanks
sendusing
you too
Oke!
Re: Today
Secret!!
This way..

The body of the infected mail will be any of the following;

Dear [CONTACTNAME]
Please, to read this detail on attacmnet and give me your best response as soon as possible..!
Thanks a lot!
Best Regards,

Dear [CONTACTNAME]
Just for information if you need, sorry... but its up to date..
See the detail on attachment, I waiting your prompt replay, thx!

Dear [CONTACTNAME]
This email maybe it's too late, but I hope you know this information, couse I know who you are...
don't forget to give me your response..!
Rgds,

The name of the infected attachment will be any of the following;

onSchedule.xls
AllProduct.xls
Technicalads.xls
Budget.xls
CollectionList.xls
CompanyBudgetting.xls
Kamasutra.xls
CurriculumVitae.xls
FantasticOffer.xls
PlayboyOffer.xls
FYI.xls
GodBless.xls
ProjectThisMonth.xls
GrandOpening.xls
ProductsLowPrice.xls
HRDList.xls
itsPossible.xls
TimeFrame.xls
JakartaUnderGround.xls

Upon execution, it copies as userinit.exe, HRDList.xls, readme.drv, b.dll in Windows folder and WindowsServerService.exe, Real.dll in System folder.

Also drops as system32.sys, Scewin.txt, help002.hlp in Windows foder and winrun.dll, Express.ocx, e.dll, autodisk.sys in System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The worm spreads through mapped and network drives.

This worm first appeared on January 22, 2008.

 Other names of W32/Degnax Worm: