W32/Blackangel.A Worm

 Information about the W32/Blackangel.A Worm:

W32/Blackangel.A is a worm. The worm will infect Windows systems and spreads through MSN Messenger.

The worm sends any one of the following messages to online contacts of MSN Messenger.

jaja look a that video www.[blocked].esp.st
mira este video www.[blocked].st jaja

When the above link is clicked videosexy.zip file is downloaded on the system, this file contains Videosexy.avi.exe file. This file has the icon of Windows Media Player.

Upon execution, the worm copies itself as jesse.exe in etc folder located under Windows System folder.

It searches for files in A and C drives. It replaces each and every file found with a copy of itself using a the original file name.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It also modifies registry at the following location to disables the Task Manager.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The worm tries to terminate some of the security related processes.

This worm first appeared on May 26, 2006.

 Other names of W32/Blackangel.A Worm:

This Worm is also known as BlackAngel.A, W32.Sejese.