Worm.Thraegisa.A

Worm.Thraegisa.A is a malicious worm which comes disguised as an Internet chat application installation package. First released in 4 September 2009, Worm.Thraegisa.A will delete Interent cookies and inform its developers of the new infection, all without the user’s knowledge.

This worm is installed under false pretenses and will be drop the following file into the system32 directory of the system:

%windir%\system32\mmá.exe

After the worm firmly roots itself in the system, it will run this batch script:

\delcookes.bat

The above dropped script will delete all cookies from the Internet’s temporary files folder, and when Internet cookies are deleted PC users will find that they need to enter all of their login credentials when logging into their normal websites again. Worm.Thraegisa.A will use this opportunity to steal usernames, passwords and other sensitive information of the user.

As a further attack against the system, Worm.Thraegisa.A will contact its developers through a remote server named katomka.net.ru, to receive register the infection and receive further instructions from its developers. Worm.Thraegisa.A will also make the system more susceptible for other malware infections to infiltrate the system.

There is only one way to regain control of your PC and protect your privacy and security if you are infected with this threat, and that is to completely get rid of Worm.Thraegisa.A for good. This can more easily and safely be achieved by using a powerful security tool which will also offer adequate protection against similar future attacks and threats.