W32/Stration.RE is a worm. The worm will infect Windows systems and spreads through Instant Messaging Applications.

The worm will arrive as a dropped file from the network or downloaded from other malware.

The worm sends the following message to all online contacts of an affected system via Instant Messaging Applications.

http://www.{BLOCKED}dewanion.com/s15/52911

A copy of this worm is downloaded into the recipient's computer, when the recipient clicks on the link included in the message.

Upon execution, the worm drops a copy of itself as vbarccfg.dll, uxthipro.exe, w32tcomr.dll, w32tcomr.exe, setumgmt.dll and w32tcomr.dat in the system folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

The worm attempts to connect to some remote websites to download malicious files.

This worm first appeared on September 20, 2007.

 Other names of W32/Stration.RE Worm:

This Worm is also known as WORM_STRATION.RE.