W32/Looksky.AM is a worm. This worm is a variant of W32/Looksky.A. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be;

Your Ebay account is Suspended

The body of the infected mail will be;

Dear eBay Member,

We regret to inform you that your eBay account could be suspended if you don't re-update your
account information.

To resolve this problem please visit link below and re-enter your account information to the attached form.

The name of the infected attachment will be;

Ebay_info.exe

Upon execution of the infected attachment, the worm copies itself as sachostx.exe in the Windows folder.

It also drops the following file in Windows system folder.

attrib.ini
hard.lck
sachostb.exe
sachostw.exe
sachosts.exe
sachostc.exe
sachostp.exe
msvcrl.dll

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the extensions wab & htm and collects all the available email addresses from the infected system.

This worm also downloads updates of itself from the following links;

http://p[BLOCKED]u.ws:8080/download.exe
http://u[BLOCKED]u.ws:8080/download.exe

The worm also logs keystrokes to the file attrib.ini in an attempt to steal user names and passwords.

This worm first appeared on January 15, 2006.

 Other names of W32/Looksky.AM Worm:

This Worm is also known as WORM_LOCKSKY.AM.