Worm.Lamin.A

Worm.Lamin.A is a malicious worm first detected on 7 April 2009. Since then Worm.Lamin.A has gone on to infect thousands of PCs worldwide. This threat will use installed Internet chat clients to send messages to the user’s contacts which contains a hyperlink to a copy of the worm, in this way replicating itself. Should the recipient of the message execute the worm by clicking on the link, the worm will install itself on that PC, stop services and modify Windows settings. The installed backdoor is identified as Backdoor:Win32/Lamin.A.

Win32/Malinbot.A
Trojan.Minute
Trojan-Dropper.Win32.Agent.avam
Generic.dx
W32/Busky.KENN
Bck/Mirbased.BT
W32/IRCBot-ADJ
W32.Mibling
Backdoor:Win32/Lamin.A
Worm:Win32/VB.BN

The threat is classified as severe, and users are urged to get rid of Worm.Lamin.A at the earliest opportunity. Because of Worm.Lamin.A’s clandestine infiltration of the system, users will not be aware of its presence on the system. The presence of the following files on the system will be a clear indication of Worm.Lamin.A’s presence on the system:

%ProgramFiles%\Microsoft Office\Office11\control.ini
%ProgramFiles%\Microsoft Office\Office11\drvics32.dll
%ProgramFiles%\Microsoft Office\Office11\hjwgsd.dll
%ProgramFiles%\Microsoft Office\Office11\jwiegh.dll
%ProgramFiles%\Microsoft Office\Office11\pub60sp.mrc
%ProgramFiles%\Microsoft Office\Office11\remote.ini
%ProgramFiles%\Microsoft Office\Office11\ruimsbbe.dll
%ProgramFiles%\Microsoft Office\Office11\yofc.dll
%ProgramFiles%\Microsoft Office\Office11\smss.exe

The abnormal or unexpected termination of Windows Firewall and Internet Connection Sharing, Automatic Updates and Security Center will also be a clear indication of the Worm.Lamin.A’s presence on the system.

The worm is installed on the PC by the user visiting a malicious hyperlink after receiving an instant message. The file icon of the downloaded malware may resemble a Microsoft Word or Adobe document as an attempt to gain the user’s trust and trick him into opening the worm copy. The worm has been known to use Adobe Gamma Loader.com, plugin.exe and package.exe as its name.

In order to prevent Worm.Lamin.A from damaging the PC any further, and to restore your system’s security and privacy destroy Worm.Lamin.A with the help of a powerful security tool. Not only will this be a direct investment in your system’s future security, but you will also annihilate Worm.Lamin.A for good and regain control of what is rightfully yours.