Worm.Duptwux.A

Worm.Duptwux.A is a malicious self propagating worm that will spread itself from PC to another without any user action being required. It spreads itself in numerous ways, most commonly through removable or network drives, or by attempting to exploit certain susceptibilities in its targeted computers’ security. Worm.Duptwux.A will also attempt to spread itself through platforms that require user interaction to run. This is done by sending itself as an attachment to an instant or email message, or by sending a link to in the body of an email message.

It will make the email or instant message seem convincing, and will in that way succeed in tricking the user to download the attachment or click on the link. When the user does this, Worm.Duptwux.A will be executed and his PC will be infected. Worm.Duptwux.A will perform all of its tasks in the system’s background, which means that the user will have a tough time identifying Worm.Duptwux.A on the system in the first place. The presence of the following files on the PC is an indication of a Worm.Duptwux.A infection:

help.hlp
jusched.exe
fav .exe
rln.exe

Worm.Duptwux.A will create the following file on the targeted drive when spreading:

Fav.exe

It will also place an autorun.inf file in the root directory of the targeted drive. Such autrun.inf files will contain execution instructions for the OS so that when the removable drive is accessed from a different system which also supports the Autorun feature, Worm.Duptwux.A will be launched on that PC.

Worm.Duptwux.A will add itself to applications authorized to access the Internet without being stopped by the Firewall. It will then contact the following hosts using these ports:

elegan_786444.el.funpic.org using port 21
elegan_786444.el.funpic.org using port 10015

The reason for Worm.Duptwux.A connecting to these hosts is to confirm a new infection to its authors, receive configuration data and to download and execute additional arbitrary files that will contain more malware. It will also relay stolen information from the user’s PC, like websites visited and financial information.

In order to protect your PC against the devastation Worm.Duptwux.A will wreak, destroy Worm.Duptwux.A with the help of a powerful security tool. This will not only erase Worm.Duptwux.A from your PC, but also protect your system against similar attacks in future.