W32/Pahooka.A is a worm. The worm will infect Windows systems and spreads through network.

Upon execution, the worm copies itself as msfirewall.exe in Windows System folder.

It also drops copies of itself as the following in respective folder.

explorer.exe in Common Files folder which is the subfolder of Program Files folder.

msdos.pif in Windows folder.

windows.exe, love.exe, star.exe, downloads.exe, books.exe, computer.exe, microsoft.exe, norton.exe, pacman.exe, my pictures.exe, zoo.exe , music.exe, pizza.exe, sex.exe, sky.exe, program files.exe, teens.exe, home.exe and ebooks.exe in root of C: drive

It creates a batch file which deletes the files related to some of the antivirus software.

This worm will delete the templates stored in Microsoft Office.

It modifies the registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It disables the following windows functionalities.

Folder options
Control panel
Run
Find
Registry Editor
Printers and faxes
System restore
Task Manager
Command Prompt

This worm spreads by dropping a copy of itself in the mapped network drive. It creates autorun.inf file in the mapped drive to execute itself whenever the drive is accessed.

It tries to connect to a remote website and downloads a file.

This worm first appeared on July 17, 2007.

 Other names of W32/Pahooka.A Worm: