W32/Looked.CM is a worm. The worm will infect Windows systems.

Upon execution, the worm copies itself as rundl132.exe, logo_1.exe and RichDll.dll in Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

This worm infects the executable files found on the infected system. It also attempts to copy itself to remote network shares.

It creates _desktop.ini in various folders on the infected computer. These files can be deleted from the infected computer.

This will terminate some of the security related processes.

This worm first appeared on March 20, 2007.

 Other names of W32/Looked.CM Worm:

This Worm is also known as W32/Looked.CM, Worm.Win32.Viking.ix, W32/HLLP.Philis.ic.