W32/Looksky.A Worm

 Information about the W32/Looksky.A Worm:

W32/Looksky.A is a worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be Skylook for Skype.

The body of the infected mail will be.

Hello, You asked me to send you Skylook - here it is:

With Skylook, you can get 1 hour of world-wide calls FREE!

Skype? Voice Calls (as MP3), Instant Messages, Email, Appointments, Contacts all organized and under control in Microsoft? Outlook?!

Halloween Special!

Try it before October 31 and receive 1 hour of free world-wide calls (SkypeOut). Also You`ll get 40% off a business license or 30% off a home license.

Use Skylook 1.0 to record Skype? VoIP Calls to MP3!

Skylook attached

The name of the infected attachment will be skylook_1.exe.

Upon execution of the infected attachment, the worm copies itself as sachostx.exe in the Windows folder.

It also drops the following file in Windows system folder.

attrib.ini
hard.lck
sachostw.exe
sachosts.exe
sachostb.exe
sachostc.exe
sachostp.exe
msvcrl.dll

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm collects all the available email addresses from Windows Address Book and .htm files of the infected system.

This worm also downloads updates of itself from the following link;

http://[blocked]/download.exe

This worm first appeared on October 24, 2005.

 Other names of W32/Looksky.A Worm: