W32/Kango.D is a trojan. The trojan will infect Windows systems.

The trojan will arrive as a dropped file of another malware or may be downloaded from the Internet.

Upon execution, it drops as kbd.dll, test.dll and svchost.exe in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm generates the fake error message:

"Microsoft Word has generated an error and will be closed!"

The worm attempts to connect to some remote websites to download malicious files.

This trojan first appeared on November 15, 2007.

 Other names of W32/Kango.D Trojan: