dansmug used our newssubmit to tell us that the KaZaa network is the owner of the second virus in it's history.
The virus picks some random populair names of files that are swapped on the network and executes itself everytime Windows is started.
When first executed the worm will copy itself to the Windows system folder as explorer32.exe. It will then create registry entries so that the copy is run each time Windows is started. |
W32/KWBot-A will attempt to get unsuspecting users to download copies of itself by using filenames which may be attractive to other users, such as film titles or popular software
The worm may also allow attackers to gain control of an infected computer using commands transmitted over IRC.
The question raises, since we know record labels are putting fake songs on the file swapping netowrks, do they also infect these networks with worms ?
Source: Sophos.com
