W32/Shangxing.A is a worm. The worm will infect Windows systems.

Upon execution, the worm creates the following files:

windows.exe in %CommonProgramFiles%\Microsoft Shared\MSInfo folder.
_windows.exe in the Windows System folder.

The worm copies itself as windows.exe in the root of all local and removable drives.

It also copies AutoRun.inf in the root of all local and removable drive so that it is executed whenever the drive is accessed.

The worm creates the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\windows

The worm injects malicious code into calc.exe and iexplore.exe, and creates hidden instances of the same.

If the hidden instance of iexplore.exe is ended, the hidden instance of calc.exe restarts it.

The worm attempts to open a back door to liuzhaoman.5166.info domain through TCP port 8181, which gives the attacker the control over the infected computer.

This worm first appeared on November 22, 2007.

 Other names of W32/Shangxing.A Worm:

This Worm is also known as W32.Shangxing.A.