minimal-minimal

W32/Trab.worm

W32/Trab.worm

Threat Detail

  • Malware Type: Virus
  • Malware Sub-type: Floppy Worm
  • Protection Added: 2003-03-28

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.


Minimum Engine

5400.1158

File Length

196,608

Description Added

2003-03-28

Description Modified

2003-03-28

Malware Proliferation

fpo-ti-severity-legend logo-new-mcafee

This is a floppy worm. It was detected as "New Floppy Worm" with heuristic scanning turned on.

When run, the worm copies itself to c:\WINDOWS\SYSTEM\W16OFF.exe. It creates the following registry key in order to run at Windows start up:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    "Spool32" = C:\WINDOWS\SYSTEM\W16OFF.exe

Every 2-3 minutes, the worm copies itself to floppy drive A:. It creates the following files:

  • A:\command.com - the worm itself.
  • c:\WINDOWS\SYSTEM\HTA.doc - word document.
  • A:\TRAP.doc - same word document.
  • c:\listf.vxd - a log file.

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

The worm propagates via floppy disk.
Existence of the files and registry keys mentioned above.