Rahiwi is a worm that spreads removable media, mapped network drives and also by copying itself to local disks. The parasite changes Internet Explorer default home and search pages, modifies web browser window titles, screen saver settings and various system settings. It also disables Registry Editor, Task Manager and Command Prompt. Furthermore, Rahiwi attempts to terminate active antiviruses, security-related tools and some other programs. It secretly runs on every Windows startup and every time executables or batch files are launched. The worm also loads in Windows Safe Mode.
