W32/Zaflen.A is a worm. The worm will infect Windows systems and spreads through email.

Upon execution, it drops multiple copies of itself in various locations.

CoolWorld.exe
Image Viewer.com
phil.constitution.scr
agila.scr
AutoRun.ini
Microsoft Word Document.scr
Microsoft Word Document.scr
New Microsoft Word Document.scr
lsass.exe
services.exe
csrss.exe
mskernel.exe
mskernel.exe

It also creates autorun.inf file in the root of C drive

The worm modifies registry entries at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It the searches for the files with the following extensions to prepend itself to them.

doc
rtf
jpg
gif
png

This worm first appeared on June 15, 2007.

 Other names of W32/Zaflen.A Worm: