|
|
|
VIRUS NAME
: W32/EnerKaz.worm.b
Virus
Characteristics
This worm spreads
via the KaZaa peer-to-peer file-sharing network. It requires the KaZaa software
to be running to propagate, and requires that at least 98 different local
content folders are being shared. When run, the worm displays a message box.
It creates the folder %WinDir%\Sys32 and copies itself there as spank_britney.exe.
It then modified the KaZaa sharing folder to point to the newly created one.
This is accomplished through a registry key:
- HKEY_CURRENT_USER\Software\Kazaa\LocalContent\dir99=012345:C:\WINDOWS\sys32
An additional key is created
to assure that KaZaa's sharing setting is enabled:
- HKEY_CURRENT_USER\Software\KAZAA\LocalContent\DisableSharing=0
Symptoms
Presence of %WinDir%\Sys32\spank_britney.exe
Method
Of Infection
This worm spreads via the KaZaa file-sharing network by luring users into downloading
and running itself.
|
|
|
