Home Malware Programs Worms W32.Imaut

W32.Imaut

Posted: December 4, 2009

W32.Imaut is a dangerous Windows platform worm that replicates itself through removable storage devices. W32.Imaut is also able to install and execute other harmful programs on a compromised machine. W32.Imaut may put your confidential information at risk by installing malicious programs like keyloggers. Use a reliable security tool to remove W32.Imaut from both your PC and your removable drives.

Aliases

not-a-virus:Monitor.Win32.Ardamax.ae (Kaspersky Lab)

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System%\28463\svchost.001
    2 %System%\28463\svchost.exe
    3 %System%\regsvr.exe
    4 %System%\setting.ini
    5 %System%\setup.ini
    6 %System%\svchost .exe
    7 %Windir%\regsvr.exe
    8 %Windir%\Tasks\At1.job
    9 %Windir%\Tasks\At2.job

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Loading...