W32/Pykspa.A is a worm. The worm will infect Windows systems and spreads through Skype Instant Messenger.

Upon execution, the worm creates (original file name).jpg and (random letters).exe in the Windows Temp folder and the file attributes are set as hidden, read-only, and system.

The worm also creates Invisible002.dll and Skype.exe in the Windows System folder.

The worm modifies the registry at the following location to load itself during each startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm then displays the (original file name).jpg image.

The worm also sends out a Skype Instant Message, with any of the following message:

(devil)
(rofl)
:)
:D
bet cia nesveikai
kaip tau tokia? :D
matei kur sandros foto idejo?
netau cia
oi netau cia turejo but sory
paziurek kokia foto andrius atsiunte
pz ane?
uj netau sry
ziurek kur sandros foto imeciau

The message also contains the link http://www.papai.ru/foto_galerija/sandr

The worm tries to access some of the following URLs:

http://aras.allfreehost.net/calc/coun
http://aras.lookingat.us/index
http://asilas.my-php.net/index
http://bobodada.3-hosting.net/index
http://bobos45.bebto.com/index
http://gogo442.hatesit.com/index
http://jackdaniels.110mb.com/index
http://timboss.1majorhost.com/index
http://zozole.php0h.com/index

This worm first appeared on April 17, 2007.

 Other names of W32/Pykspa.A Worm:

This Worm is also known as W32.Pykspa.A, Mal/Pykse-A, IM-Worm.Win32.Pykse.a, W32/Pykse.worm.a, W32/Pykse-B.