ENN - Electric News.net
Free e-mail alerts & newsletter - Sign up here
Free e-mail alerts & newsletter - Sign up here
Edit your alerts
Let us know how to make ENN better!
Take our reader's survey.
Post a Job

Students rebel against IT
Not so long ago students fought tooth and nail to get into IT courses. Now, they are shunning such studies, with massive implications for Ireland's reputation as a high-tech centre.
More here



Another worm spreads through KaZaA
Friday, August 23 2002
by The Register

Send story to a friend
Print this story
Virus watchers have discovered the latest in a line of viruses targeted at file-sharing networks.

The Duload worm is spreading across the KaZaA file-exchange network, anti-virus firm Kaspersky Labs warned on Thursday based on reports of infections from Italian Internet users, writes John Leyden.

Duload appears as a Windows executable written in Visual Basic either 18432 bytes or, in its compressed form, 7680 bytes in size.

If the infected file is accidentally opened, "Duload" copies itself to the Windows system directory under the name "SystemConfig.exe" and modifies the system registry so that this file automatically loads each time Windows is started. Next, the Duload worm creates a folder in the Windows directory called "Media" and copies itself to this directory under 39 different names, explained in more detail in Kasperky's advisory.

Duload then once again modifies the system registry in order to make the media folder accessible to all other KaZaA network users, with the aim of furthering its spread.

One modification of the worm also downloads from the Net several Trojan programs designed to establish the unauthorised remote management of victim computers.

Anti-virus vendors are in the process of updating their tools to detect the worm. As always, the main advice remains to be vigilant about the possibility of downloading and running executable code from file-sharing Web sites.

File-sharing services are increasingly becoming a target for virus writers. In June, KaZaA users became exposed to a virus called Backdoor.K0wbot.1.3.B, which followed the infection of the network byBenjamin Benjamin worms only a month earlier.

The Register and its contents are copyright 2002 Situation Publishing. Reprinted with permission.

:: Discuss this story - Click here



    The 6th Sedona Conference in Dublin



    Powered by The CIA


    © Copyright ElectricNews.Net Ltd 1999-2002.