W32/Stration.S is a mass mailing worm. This worm is a variant of W32/Stration.A. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The 'Subject' of the infected mail will be any one of the following;

(no subject)
(random)
Error
hello
Status
Good day
Server Report
Mail Delivery System

The body of the infected mail will be;

Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sentas a binary attachment.
The message cannot be represented in 7-bit ASCII encodingand has been sent as a binary attachment

The name of the infected attachment will be any one of the following;

(random)
doc
body
data
text
file
readme
document

The extension of the infected attachment will be;

bat
cmd
exe
pif
scr
zip

Upon execution of the infected attachment, the worm copies itself as acac.dll, actxippr.dll, lsaswdmi.dll, mtxlcomm.dll and slbcslay.exe .

The worm also injects the files lsaswdmi.dll and mtxlcomm.dll into several running processes.

The worm modifies registry at the following location to load itself during each startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon\Notify

To propagate itself, the worm gathers all the available email address from Windows Address book(wab).

The worm mails itself to these addresses using its own SMTP engine.

It also attempts to connect to the following website to download a file;

http://www(blocked)cedesunjerinkas.com

This worm first appeared on September 21, 2006.

 Other names of W32/Stration.S Worm:

This Worm is also known as WORM_STRATION.SD .