W32/Kueight Worm

 Information about the W32/Kueight Worm:

W32/Kueight is a worm. The worm will infect Windows systems and spreads by copying itself to removable drives.

Upon execution, the worm copies itself in the Windows folder as any of the following:

alg.exe
wmplayer.exe
nvidia.exe

The worm also copies itself as:

cmd.com in the Windows System folder and
regedit.com in the Windows folder.

It then copies itself in the root of drives D: through K: as any of the following file name along with an Autorun.inf that points to the worm:

alg.exe
wmplayer.exe
nvidia.exe

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

The worm also modifies the Internet Explorer home page.

It then downloads and executes files from the following URLs:

http://images.sohu.net/softwareunion/1/ad156
http://woaizhe.com/updat

The worm also accesses the following URLs periodically:

http://np.814e.com
http://www.814e.com/index
http://www.study321.com/index
http://www.12v.cn
http://www.study321.com/redire

This worm first appeared on April 9, 2007.

 Other names of W32/Kueight Worm:

This Worm is also known as W32.Kueight.