W32/Sumom.A Worm

Download free anti virus software

Anti virus software information

Order anti virus software (US$ 29.95)

Protector Plus
Anti virus software for

Windows
(XP, 2000, 2003, NT, Me, 98, 95)

Exchange

NetWare

W32/Sumom.A Worm

Information about the W32/Sumom.A Worm:

W32/Sumom.A is a worm. The worm will infect Windows systems. The worm spreads through MSN Messenger and shared network drives.

The worm arrives as an infected attachment through MSN Messenger. The attachment will be any one of the following;

See my lesbian friends.pif
Jennifer Lopez.scr
My new photo!.pif
Me on holiday!.pif
The Cat And The Fan piccy.pif
How a Blonde Eats a Banana...pif
Mona Lisa Wants Her Smile Back.pif
Topless in Mini Skirt! lol.pif
Fat Elvis! lol.pif
Crazy frog gets killed by train!.pif
Annoying crazy frog getting killed.pif

Upon execution of the infected attachment, the worm copies itself as;

My new photo!.pif
See my lesbian friends.pif
Mona Lisa Wants Her Smile Back.pif
Jennifer Lopez.scr
How a Blonde Eats a Banana...pif
Annoying crazy frog getting killed.pif
Crazy frog gets killed by train!.pif
Fat Elvis! lol.pif
LOL that ur pic!.pif
lspt.exe
Me on holiday!.pif
The Cat And The Fan piccy.pif
Topless in Mini Skirt! lol.pif

In the root of Windows installed folder.

It also copies itself as FORMATSYS.EXE, SERBW.EXE in the Windows system folder and MSMBW.EXE in the Windows folder.

It also drops the following files in the root of Windows installed folder.

Message to n00b LARISSA.txt
Crazy-Frog.Html
British National Party.jpg

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm also attempts copies itself as Messenger Plus! 3.50.exe, MSN all version polygamy.exe and MSN nudge bomb.exe to the following shared folders.

My Shared Folder
Shared
eMule

It also copies AUTORUN.INF and AUTORUN.EXE to all the CD ROMs written in the infected system.

The worm tries to terminate some of the security related processes. It also blocks access to some of the security related websites.

This worm first appeared on 7th March, 2005.

Other names of W32/Sumom.A Worm:

This Worm is also known as WORM_FATSO.A, Fatso.A, W32.Serflog.A, IM-Worm.Win32.Sumom.a, W32/Sumom-A..

Click here to download a 30 day Evaluation Copy of
Protector Plus anti virus for your operating system

About Protector Plus Anti virus Software Packages:

Proland Software is the developer of Protector Plus range of anti virus software packages. Protector Plus anti virus is available for Windows XP, Windows Me/98/95, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of anti virus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus antivirus software can detect and remove W32/Sumom.A Worm reliably.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

You can download the 30 day evaluation copy of
Protector Plus anti virus software free of cost for these platforms:

Windows | Exchange | NetWare

Download free anti virus software | Anti virus software information | Order anti virus software