Feeds

Worm spreads through KaZaA network, again

Don't download Duload

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Virus watchers have discovered the latest in a line of viruses targeted at file sharing networks.

The Duload worm is spreading across the KaZaA file-exchange network, antivirus firm Kaspersky Labs warns today based on reports of infections from Italian internet users.

Duload appears as a Windows executable written in Visual Basic either 18432 bytes or, in its compressed form, 7680 bytes in size.

If the infected file is accidentally opened "Duload" copies itself to the Windows system directory under the name "SystemConfig.exe" and modifies the system registry so that this file automatically loads each time Windows is started.

Next, the Duload worm creates a folder in the Windows directory called "Media" and copies itself to this directory under 39 different names, explained in more detail in Kasperky's advisory.

Duload then once again modifies the system registry in order to make the Media folder accessible to all other KaZaA network users, with the aim of furthering its spread.

One modification of the worm also downloads from the Net several Trojan programs designed to establish the unauthorised remote management of victim computers.

Antivirus vendors are in the process of updating their tools to detect the worm. As always, the main advice remains to be vigilant about the possibility of downloading and running executable code from file sharing Web sites.

File sharing services are increasingly becoming a target for virus writers. In June, KaZaA users became exposed to a virus called Backdoor.K0wbot.1.3.B, which followed the infection of the network by Benjamin worms only a month earlier. ®

Related Stories

GamesSpy and KaZaA infected by viruses
Altnet wakes up as worm spreads through KaZaA
Popular file-share utilities contain Trojans

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.