W32/Looksky.T Worm

 Information about the W32/Looksky.T Worm:

W32/Looksky.T is a worm. This worm is a variant of W32/Looksky.A. The worm will infect Windows systems and spreads through email.

Upon execution of the infected attachment, the worm copies itself as batserv2.exe in Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also drops sysc.exe in Windows System folder. This file is used by the worm to gather email address from the infected system. It gathers email address from white.lst file of MS Outlook.

It also attempts to download updates of itself from the following link;

http://[BLOCKED]/report/upd1.exe
http://[BLOCKED]/report/upd1.exe

This worm first appeared on December 23, 2005.

 Other names of W32/Looksky.T Worm:

This Worm is also known as WORM_LOCKSKY.T .