W32/Lecivio is a worm. The worm will infect Windows systems and spreads by copying itself to all mapped drives.

Upon execution, the worm may create any of the following files in the Windows System folder:

cmdial.exe
viollice.exe
userinit.exe
inf.exe
of.ico
dnandlk.exe
dpnmodempl.dll
rpcss.exe

It may also create GOKU.exe in C: and Microsoft Office.lnk in C:\Documents and Settings\All Users\Start Menu\Programs\Startup folder.

Then worm creates autorun.inf and inf.exe in the root of all drives, including removable drives.

It modifies the registry at the following location to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

It also creates the following registry entry and registry subkeys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\rpcss.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dpnmodempl
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPFilter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPSSL

The worm also attempts to download and execute potentially malicious files from the Internet.

This worm first appeared on May 30, 2007.

 Other names of W32/Lecivio Worm:

This Worm is also known as W32.Lecivio.