W32/P2load.A is a worm. The worm will infect Windows systems and spreads through P2P software like KaZaA, iMesh, eMule and Shareaza.

Upon execution, the worm copies itself as winlogin.exe in the Windows System folder.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Displays a message box with the following message.

File become outdated...

Error: File "vb2.dll" is not current any longer!
In order to update the file "vb2.dll", press the button "OK" please
and announce (free) to download the current file "vb2.dll".

It tries to download a .dat file from any one of the following and replaces the host file with the same.

http://www.[blocked].de/stat.dat
http://www.[blocked].com/stat.dat
http://www.[blocked].de/stat.dat

This worm first appeared on September 18, 2005.

 Other names of W32/P2load.A Worm:

This Worm is also known as W32.P2load.A, WORM_P2LOAD.A.