W32/Opanki.AC is a worm. The worm will infect Windows systems. The worm spreads through AOL Instant Messenger and network.

Upon execution, the worm copies itself as express.exe in the Windows System folder.

It also drops xz.bat file in the root of the Windows Installed drive.

It alters the windows registry at the following location to load itself during next startup;

HKEY_ CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

To propogate itself, the worm sends the following link to all the online contacts in AOL Instant Messenger.

http://[blocked].firstringtonesforyou.com

On clicking the above link, a copy of worm will be downloaded into the computer.

This worm also drops a copy of itself to the network shares. If the network share is password protected then the worm will find the network username and password using a pre-configured list of Username and Password.

It also tries to terminate some security related services.

This worm first appeared on October 30, 2005.

 Other names of W32/Opanki.AC Worm:

This Worm is also known as WORM_OPANKI.AC .