W32/Chike Worm

 Information about the W32/Chike Worm:

W32/Chike is a worm. The worm will infect Windows systems and spreads through removable drives and network shares.

The worm will arrive as a dropped file from the network or removable drive.

Upon execution, the worm copies itself as chickie.exe in the windows folder and svchost.exe int the Local Settings\Application Data folder.

The worm modifies registry at the following location to load itself during each startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_ALL_USERS\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm modifies Explorer settings and disable system restore.

It also copies 1_Saves.exe and autorun.inf in the removable drives.

This worm first appeared on November 29, 2007.

 Other names of W32/Chike Worm:

This Worm is also known as W32/Chike, W32/Rubble-C, Win32/VB.EG, WORM_VB.FAF, W32/VBWorm.NFM, Virus.Win32.VB.eg