Home Malware Programs Worms W32.Custam

W32.Custam

Posted: March 29, 2010

W32.Custam is a malicious computer worm that can easily spread across local networks. W32.Custam creates a backdoor on infected computers for other malware to enter the system. W32.Custam will connect to an IRC server to receive malicious commands from hackers. W32.Custam can also propagate through removable drives and should be removed immediately once detected on any system.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %SystemDrive%\[RANDOM FOLDER NAME]\[SID]\[RANDOM FILE NAME].exe
    2 %SystemDrive%\[RANDOM FOLDER NAME]\[SID]\DeSkToP.ini

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{63KLC5K0-4OPM-00WE-AAX8-17EF1D187263}
Loading...