W32/Kik.A Worm

 Information about the W32/Kik.A Worm:

W32/Kik.A is a worm. The worm will infect Windows systems, spreads via IRC channels.

The worm will arrive as a dropped file of another malware or may be downloaded from the Internet.

Upon execution, the worm copies printers.exe in the Windows System folder and drops notiffy.dll file in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

The worm listens for commands from the remote attacker and then performs the following actions:

silently download, install and run new software, including updates of its software
send notification messages to remote locations
steal confidential information
inject its code into other processes

This worm first appeared on July 25, 2007.

 Other names of W32/Kik.A Worm:

This Worm is also known as W32/Kik-A, IRC-Worm.Win32.Agent.a.