W32/Mancsyn is a worm. The worm will infect Windows systems and spreads by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205).

Upon execution, the worm creates:

rasman32.exe in the Windows System folder,
filex.exe in the Windows Temp folder,
mmedia.exe in the Documents and Settings\All Users\Start Menu\Programs\Startup folder.

It then deletes any of the following files from the Windows System folder, if present

acrmon32.exe, acroup.exe, acroup32.exe and cvrss.exe

It may also deletes any of the following files from the Windows Startup folder, if present

Task Manager.exe and taskman.exe.

It modifies the registry at the following location to ensure its automatic execution at every system startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm connects to the following URL's for configuration and to download more files:

http://srv01.bashchelik.com/pcv(Blocked)
http://dl01.bashchelik.com/dcv(Blocked)

The worm may also contact any of the following web servers and attempt to download a file and save it as filex.exe in the Windows Temp folder.

srv02.bashchelik.com
srv01.debelizombi.com
srv02.bashchelik.com
srv01.debelizombi.com

The worm also attempts to spread to other computers by exploiting the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (BID 8205) vulnerability on TCP port 445.

This worm first appeared on March 25, 2007.

 Other names of W32/Mancsyn Worm:

This Worm is also known as W32.Mancsyn.