Aliases: W32.Imalag.B, Virus.Win32.Afgan.a, AdWare.NaviPromo.M, Rootkit.Win32.Agent.akr, W32.Spybot.Worm
Variants: [email protected], Mal/EncPk-CR, Infostealer.Gampass, Win32.SuspectCrc, Trojan.Win32.Agent.bknn

Classification: Malware
Category: Computer Virus

Status: Inactive
Spreading: Slow
Geographical info: Asia, South America, Europe
Removal: Easy
Platform: W32
Discovered: 03 Oct 2008
Damage: Low

Characteristics: The W32.Imalag.A like most viruses targets executable files that are stored in the local hard drive of the infected computer system. Executable files which are infected by this malware normally become corrupted or unusable. This threat has also been observed to attempt to connect to predetermined websites in order to download and execute additional files. The websites contacted by this malware are known to be malicious and may be under the control of the attacker.

More details about W32.Imalag.A

This malware is normally dropped into a vulnerable computer system as an executable file that uses an icon that resembles a calculator. Once the W32.Imalag.A is launched into the target computer system it will search for the location of the executable file for the Windows Explorer and copy it into a temporary folder where it is renamed. The temporary folder will be created by the W32.Imalag.A solely for this purpose. This means that the Shell_TrayWnd Windows class will also be negatively affected by this malware. Once the executable file of the Windows Explorer has been infected, the W32.Imalag.A will randomly select other EXE format files and infect them as well. The infected file normally increases by 24,576 bytes in size.

If the Russian language pack of the operating system is installed, the W32.Imalag.A will display a message box with text using the Cyrillic language. However, if the language pack is not present in the infected computer system, the contents of the message box will appear as garbage characters. The W32.Imalag.A will attempt to create a connection to Web servers that are based in Russia. These servers store data that may be used to further the infection in the compromised machine or to update the codes of the W32.Imalag.A malware. The connection can be hijacked and exploited by another malicious author.