1. Symantec/
  2. Security Response/
  3. W32.Gubed.int


Risk Level 1: Very Low

June 21, 2002
February 13, 2007 12:00:14 PM
Also Known As:
WORM_GUBED.A, W32.Gubed@mm
Systems Affected:

W32.Gubed.int is an intended mass-mailing worm that attempts to send itself to all email addresses that it finds on an infected computer. The subject of the email message is "Congratulations for your site," and the attachment is "WebMakeFullInstall.exe." The worm also drops a script that is an intended mass-mailing worm, but due to bugs in the code, the script does not perform the mass-mailing functionality.

The worm copies itself as \%System%\DebugW32.exe, copies itself five times to both the \Windows and \Windows\System folder, and creates the Start.vbs file in the Startup folder. Start.vbs attempts to overwrite .vbs files that are in the My Documents folder and its subfolders.

Antivirus Protection Dates

  • Initial Rapid Release version June 24, 2002
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version June 24, 2002
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date June 26, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Douglas Knowles

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube