W32/Stration.CX is a mass mailing worm. This worm is a variant of W32/Stration.A. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The 'Subject' of the infected mail will be any one of the following;

Status
Mail Delivery System
Mail server report.
Mail Transaction Failed
picture
test
Error
hello
Good day
Server Report
(no subject)

The 'Body' of the infected mail will be any one of the following;

Mail transaction failed. Partial message is available.

The message contains Unicode characters and has been sent as a binary attachment.

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment

"Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).


Using the new bug in the Windows, these viruses infect the computer unnoticeably. After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service"

The name of the infected attachment will be any one of the following;

(random)
doc
body
data
text
test
file
readme
document
Update-KB(random numbers)-x86
.
The extension of the infected attachment will be;

bat
cmd
exe
pif
scr
zip

Upon execution of the infected attachment, the worm copies itself as (random characters).exe in Windows System folder.

The worm adds a registry subkey at the following location;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

To propagate itself, the worm gathers all the available email address from Windows Address book(wab).

The worm mails itself to these addresses using its own SMTP engine.

It also attempts to connect to the following website to download malicious file;

http://www6.vedasetionkderun.com/819/n{Blocked}
http://www4.vedasetionkderun.com/chr/819/l{Blocked}

This worm first appeared on October 18, 2006.

 Other names of W32/Stration.CX Worm:

This Worm is also known as W32.Stration.CX@mm.