Home Malware Programs Worms Woospi

Woospi

Posted: April 9, 2009

Woospi (also known as W32.Woospi) is a typical computer worm. It spreads via removable drives or spam emails usually as an MS PowerPoint attachment and if opened, the Woospi worm copies itself to every removable media plugged into the compromised machine.

Woospi uses the autorun.inf file to spread through these devices onto the computer that the infected drive or media is plugged into. It does this through the Autorun function built into Windows where the drive is automatically opened allowing the Woospi infection to spread.

Woospi tracks and logs all your internet traffic, and makes a PC vulnerable to remote attacks. To ensure total integrity of your system Woospi must be detected and removed immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %DriveLetter%\autorun.inf
    2 %DriveLetter%\PeerCM.exe
    3 %ProgramFiles%\Internet Explorer\ws2_42.dat
    4 %ProgramFiles%\Internet Explorer\ws2_42.dll
    5 %Windir%\ime\6d29fc4a-1067-b31d-00dd010662da
    6 PeerCM.exe
Loading...