W32/Chod.G Worm

 Information about the W32/Chod.G Worm:

W32/Chod.G is an worm. This worm is a variant of W32/Chod.A. The worm will infect Windows systems and spreads through MSN Messenger and AOL Instant Messenger.

Upon execution of the infected attachment, the worm copies itself as csrss.exe in the Windows folder and it also drops csrss.dat and csrss.ini in the Windows folder.

It also creates a shortcut csrss.lnk in the Windows Startup folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AdvancedHidden
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccessStart
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srserviceStart

The worm blocks the access to some security related websites. The worm tries to terminate processes of some security related software installed in infected computer.

To propogate itself, The worm sends a link to the copy of itself to all users in the MSN Messenger and AOL Instant Messenger contact list.

This worm first appeared on August 29, 2005.

 Other names of W32/Chod.G Worm:

This Worm is also known as W32/Chode-G.