W32/Silly.CQ is a worm. The worm will infect Windows systems.

The worm is downloaded while the user visits an malicious website.

Upon execution, the worm copies itself as crsss.exe in Windows System folder.

The worm modifies registry at the following location to load itself during each startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also copies autorun.inf file in Windows System folder.

The worm injects an Iframe tag to the files with .htm extension and also to the below mentioned files.

conn.asp, default.asp, default.php, index.asp and index.php

It drops a copy of itself to all removable and mapped drives as niu.exe.

It connects to a remote website to download a text file. It saves the downloaded text file as C.TXT in Windows System folder.

The said text file contains links to several different malwares.

The worm deletes all the files with .gho extension found in the computer.

This worm first appeared on Aug 17, 2007.

 Other names of W32/Silly.CQ Worm: