W32/Whacker.A Worm

 Information about the W32/Whacker.A Worm:

W32/Whacker.A is a worm. The worm will infect Windows systems, spreads through removable media and infects various file types.

Upon execution, the worm drops interview.exe in the Windows System folder.

It also creates a service named Sysintevet, and modifies the registry at the folllowing location to launch itself at every Windows startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

The worm also creates following hiddens files in the root of all mapped drives:

BLACK-DAY.exe
autorun.inf

The worm overwrites the first 258,048 bytes with a copy of itself to the files found on all mapped drives that have the following extensions:

com
exe
dll
lnk
msc
pif
scr

These infected files also have the string '.wswhacker' appended to them.

The worm also adds an iframe to all files which have the following extension, which refers to http://www.dadayouxi.net/index

asp
aspx
htm
html
jsp
php

This worm first appeared on April 16, 2007.

 Other names of W32/Whacker.A Worm:

This Worm is also known as W32.Whacker.A.