W32/Anixma.A Worm

 Virus Information - W32/Anixma.A Worm:

W32/Anixma.A is a worm. The worm will infect Windows systems and spreads through AOL Instant Messenger.

Upon execution, the worm sends the following link to the buddy list of AOL Instant Messenger:

http://[blocked]/misscleo6969/RitaDisaster.pif

On clicking the above link, an executable file RitaDisaster.pif will be downloaded to victim's system.

Upon execution of the RitaDisaster.pif file, the worm copies itself using a random file name in the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run