Newest “IQ Test” Is Pure Evil

January 25, 2010 – 5:49 PM

Named Win32.Worm.Zimuse.A, this new nasty claims to be an IQ Test but is really a worm that will create about 7-11 copies of itself and store them in critical areas of your Windows system and then destroy the first 50KB of the Master Boot Record (MBR) after X number of days (it’s being reported that variant A is 40 days, and variant B is 20 days).

The worm sets itself into the registry at:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]”Dump”=”%programfiles%\Dump\Dump.exe”

It also creates the following 2 “driver” files:

%system%\drivers\Mstart.sys
%system%\drivers\Mseu.sys

Source:
http://www.malwarecity.com/blog/malware-alert-win32wormzimusea-the-hard-disk-wrecker-736.html