Stration

<h2 id="details">Details</h2>
<p>The first variant of the Stration family was reported in late September 2006.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> It was quickly discovered that the worm program, as well as propagating itself by sending out copies via e-mail, was downloading new variants from one of a number of remote servers. These variants were generated by a program on those servers under control of the worm's creator(s). Computer security firm <a href="/facts/F-Secure/9axTbEIe">F-Secure</a> has worked with <a href="/facts/Internet_service_provider/dUacAxef">ISPs</a> to shut down <a href="/facts/Domain_name/FDLD2m5G">domains</a> hosting the variants of the worm.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> In November 2006, the Stration worm was the most widespread malware infection reported, accounting for around one-third of reported infections.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a>
</p><p>The Stration worms employ <a href="/facts/Social_engineering_(security)/7obTw773">social engineering</a> to infect the target machine by arriving in an e-mail masquerading as a report from a mail server informing the recipient (in somewhat broken English) that their computer is infected due to an unpatched security flaw in Windows, and offering as an attachment a purported fix, which is in fact the worm program itself.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> Some later variants of the worm spread via <a href="/facts/Instant_messenger/8lwwDyjK">instant messenger</a> and <a href="/facts/Skype/qdKbuh23">Skype</a> chat alerts containing a <a href="/facts/Uniform_Resource_Locator/pPD5g7Wq">URL</a> leading to the worm.<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a>
</p>
<h2 id="notes">Notes</h2>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>Kirk, Jeremy (2006-10-31). "Tricky New Malware Challenges Security Vendors - PC World". Archived from the original on 2007-02-17. <a href="https://web.archive.org/web/20070217183840/http://www.pcworld.com/article/id%2C127711/article.html" target="_blank">https://web.archive.org/web/20070217183840/http://www.pcworld.com/article/id%2C127711/article.html</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>"W32.Stration@mm - Symantec.com". 2006-10-03.[dead link] <a href="http://smallbiz.symantec.com/security_response/writeup.jsp?docid=2006-092111-0525-99" target="_blank">http://smallbiz.symantec.com/security_response/writeup.jsp?docid=2006-092111-0525-99</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Kirk, Jeremy (2006-10-31). "Tricky New Malware Challenges Security Vendors - PC World". Archived from the original on 2007-02-17. <a href="https://web.archive.org/web/20070217183840/http://www.pcworld.com/article/id%2C127711/article.html" target="_blank">https://web.archive.org/web/20070217183840/http://www.pcworld.com/article/id%2C127711/article.html</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>"Sophos announces top ten threats and hoaxes reported in November 2006". <a href="https://www.sophos.com/pressoffice/news/articles/2006/11/toptennov.html" target="_blank">https://www.sophos.com/pressoffice/news/articles/2006/11/toptennov.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>"Spreading Stration worm pretends to be security patch". 2006-09-25. <a href="https://www.sophos.com/pressoffice/news/articles/2006/09/stration-worm.html" target="_blank">https://www.sophos.com/pressoffice/news/articles/2006/09/stration-worm.html</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
<li id="fn:6"><p>"Warezov worm fiends target Skype". The Register. 2007-02-28. <a href="https://www.theregister.co.uk/2007/02/28/warezov_skype_im_worm/" target="_blank">https://www.theregister.co.uk/2007/02/28/warezov_skype_im_worm/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li>
</ol>

Stration open-in-new

Stration