|
The Duload worm is spreading across the KaZaA file-exchange network, anti-virus firm Kaspersky Labs warned on Thursday based on reports of infections from Italian Internet users, writes John Leyden.
Duload appears as a Windows executable written in Visual Basic either 18432 bytes or, in its compressed form, 7680 bytes in size.
If the infected file is accidentally opened, "Duload" copies itself to the Windows system directory under the name "SystemConfig.exe" and modifies the system registry so that this file automatically loads each time Windows is started. Next, the Duload worm creates a folder in the Windows directory called "Media" and copies itself to this directory under 39 different names, explained in more detail in Kasperky's advisory.
Duload then once again modifies the system registry in order to make the media folder accessible to all other KaZaA network users, with the aim of furthering its spread.
One modification of the worm also downloads from the Net several Trojan programs designed to establish the unauthorised remote management of victim computers.
Anti-virus vendors are in the process of updating their tools to detect the worm. As always, the main advice remains to be vigilant about the possibility of downloading and running executable code from file-sharing Web sites.
File-sharing services are increasingly becoming a target for virus writers. In June, KaZaA users became exposed to a virus called Backdoor.K0wbot.1.3.B, which followed the infection of the network byBenjamin Benjamin worms only a month earlier.
The Register and its contents are copyright 2002 Situation Publishing. Reprinted with permission.
|
