Spyware

W32/Banwarum is a mass mailing worm that spreads through email and network and infects Windows systems. The infected email has an attachment, which is infected with the worm. The extension of the infected attachment will be double. The first extension will be exe and second extension will be zip. W32/Banwarum may also come with gif image that contains password to extract zip file. Upon execution of the infected attachment, W32/Banwarum copies itself as mszsrn32.dll in Windows System folder. W32/Banwarum will inject dll code to winlogon.exe process to load itself during each startup.