W32/Xema.A is a worm. The worm will infect Windows systems and spreads through removable drives.

The worm will arrive as a dropped file from the network or removable drive.

Upon execution, the worm copies itself as c_10810.nls, c_19460.nls, inter32.dll, msregsv.exe, serlibk.exe, shell64.dll, shlmon.exe and windfire.exe in the System folder.

The worm modifies registry at the following location to load itself during each startup:

HKEY_CLASSES_ROOT\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32
HKEY_ALL_USERS\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

It also copies deskinf.pif and desktop.ini in the removable drives.

This worm first appeared on June 13, 2007.

 Other names of W32/Xema.A Worm:

This Worm is also known as W32.Xema.A.