Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Win32.Scold.A

Dec 10, 2003 12:03PM PST

Alias:
Category: Win32
Type: Worm
Published Date: 12/10/2003
Last Modified: 12/10/2003

CHARACTERISTICS
Win32.Scold.A is a worm that spreads via e-mail using Microsoft Outlook.

Method of Installation
When run, Win32.Scold.A copies itself to:

%Windows%\Warm.scr

Note: '%Windows%' is a variable location. The worm determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.

It adds this value to the registry so that this copy is run each time Windows starts:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ExeName32 = "%Windows%\Warm.scr"

It also makes a temporary copy of itself, using a randomly generated name, for example:

%Windows%\rkyyhu11.scr

The worm attaches this file to messages it sends.

Method of Propagation
Via E-mail

http://www3.ca.com/virusinfo/virus.aspx?ID=37740

Discussion is locked