W32/Skipi.A is a worm. The worm will infect Windows systems and spreads through Instant Messenger.

The worm may also be downloaded by an user unknowingly from malicious websites.

Upon execution, the worm copies itself as sdrivew32.exe, mshtmldat32.exe, winlgcvers.exe and wndrivs32.exe in Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

This worm spreads by sending a message through Instant Messaging application which contains a link to a copy of itself.

It modifies system host file to prevent access to some of the security related websites.

This worm first appeared on Sep 10, 2007.

 Other names of W32/Skipi.A Worm: