W32.Flamer

W32.Flamer Description

W32.Flamer is a worm that circulates through removable drives. W32.Flamer also opens a back door on the affected computer and may steal personal information from the targeted machine. W32.Flamer tries to avoid detection by anti-virus programs by saving its complex code in .OCX files, not usually checked by anti-virus programs in their default configuration. However, if W32.Flamer detects the presence of McAfee’s on-access scanner named McShield, it saves its code in .TMP files instead.

W32.Flamer Automatic Detection Tool (Recommended)

Is your PC infected with W32.Flamer? To safely & quickly detect W32.Flamer, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect W32.Flamer What happens if W32.Flamer does not let you open SpyHunter or blocks the Internet?

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	test.rar	644
2	file.exe	637
3	flame.zip	621
4	flamer.rar	614
5	Windows\System32\boot32drv.sys	N/A
6	Windows\System32\ccalc32.sys	N/A
7	Windows\System32\msglu32.ocx	N/A
8	Windows\system32\mssecmgr.ocx	N/A
9	Windows\System32\nteps32.ocx	N/A
10	Windows\System32\soapr32.ocx	N/A
11	Windows\System32\advnetcfg.ocx	N/A

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\"Authentication Packages" = "mssecmgr.ocx"

Posted: May 29, 2012 | By SpywareRemove