Alias:
Category: Win32
Type: Worm
Published Date: 12/10/2003
Last Modified: 12/10/2003
CHARACTERISTICS
Win32.Scold.A is a worm that spreads via e-mail using Microsoft Outlook.
Method of Installation
When run, Win32.Scold.A copies itself to:
%Windows%\Warm.scr
Note: '%Windows%' is a variable location. The worm determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
It adds this value to the registry so that this copy is run each time Windows starts:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ExeName32 = "%Windows%\Warm.scr"
It also makes a temporary copy of itself, using a randomly generated name, for example:
%Windows%\rkyyhu11.scr
The worm attaches this file to messages it sends.
Method of Propagation
Via E-mail
http://www3.ca.com/virusinfo/virus.aspx?ID=37740

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic