W32/Pitin is a worm. The worm will infect Windows systems and spreads through network shares.

Upon execution, the worm copies itself as Nitip.exe to every folder on local and networked drives.

It then checks for subfolders in the current folder and copies itself using the subfolder name as (subfolder name).exe

The worm uses the blank folder icon in Explorer to trick users into clicking on the malicious worm file instead of the real folder.

The worm also creates Wk86.exe in the C:\Windows\System32\3077 folder.

The worm modifies registry at the following location to load itself during each startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

It also modifies the registry to disable the Task Manager and Registry editor.

This worm first appeared on April 10, 2007.

 Other names of W32/Pitin Worm:

This Worm is also known as W32.Pitin.