Kazaa has a lot of these type of traps waiting:
W32/Oror-Fam is a family of worms, all of which are very similar to W32/Oror-B. Like W32/Oror-B, these worms can spread in an number of ways, including sending themselves out by email, copying themselves to shared drives in networks, and placing copies of themselves in folders likely to be shared via the KaZaA peer-to-peer system.
The Oror family of worms also have many or all of the following characteristics:
They pop up fake error dialogs to disguise their operation.
They create copies of themselves in your Windows folder using innocent-looking names, typically incorporating the first few letters of the computer name backwards.
They add a value to the registry key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
so that they will launch automatically every time you log on.
They edit WIN.INI so they will launch automatically every time you start your PC.
They exploit bugs in older, unpatched version of Outlook, Outlook Express and Internet Explorer so that they may launch automatically when you view infected emails.
They create mIRC scripts to distribute themselves if you have mIRC installed.
You can find additional details about the W32/Oror family of worms by looking at the analyses of W32/Oror-B, W32/Oror-K and W32/Oror-L.
|