| |
M1CUK > INFO 23.08.02 05:28l 45 Lines 1831 Bytes #999 (0) @ WW
BID : 10056-GB7FCR
Read: DB0FHN GUEST
Subj: Worm Warning for KaZaA Users!
Path: DB0FHN<DB0ZWI<DB0CHZ<DB0ERF<DB0MRW<OK0PKL<OK0PCC<OK0NAG<OK0PPL<RZ6HXA<
IK1ZNW<7M3TJZ<JE7YGF<CT2GWY<W4JAX<GB7FCR
Sent: 020822/2224Z @:GB7FCR.#16.GBR.EU #:10056 [Blackpool] FBB-7.03a $:10056-GB
From: M1CUK@GB7FCR.#16.GBR.EU
To : INFO@WW
Worm spreads through KaZaA network, again
By John Leyden
Posted: 22/08/2002 at 15:58 GMT
Virus watchers have discovered the latest in a line of viruses
targeted at file sharing networks.
The Duload worm is spreading across the KaZaA file-exchange network,
antivirus firm Kaspersky Labs warns today based on reports of
infections from Italian internet users.
Duload appears as a Windows executable written in Visual Basic
either 18432 bytes or, in its compressed form, 7680 bytes in size.
If the infected file is accidentally opened "Duload" copies itself
to the Windows system directory under the name "SystemConfig.exe"
and modifies the system registry so that this file automatically
loads each time Windows is started.
Next, the Duload worm creates a folder in the Windows directory
called "Media" and copies itself to this directory under 39
different names, explained in more detail in Kasperky's advisory.
Duload then once again modifies the system registry in order to
make the Media folder accessible to all other KaZaA network users,
with the aim of furthering its spread.
One modification of the worm also downloads from the Net several
Trojan programs designed to establish the unauthorised remote
management of victim computers. Antivirus vendors are in the
process of updating their tools to detect the worm. As always,
the main advice remains to be vigilant about the possibility of
downloading and running executable code from file sharing Web sites.
File sharing services are increasingly becoming a target for virus
writers. In June, KaZaA users became exposed to a virus called
Backdoor.K0wbot.1.3.B, which followed the infection of the network
by Benjamin worms only a month earlier.
---------------------------------------
Regards
Trev
m1cuk
Read previous mail | Read next mail
| |
