Duload Worm spreads through KaZaA network

Antivirus firm Kaspersky Labs warns today the Duload worm is spreading across the KaZaA file-exchange network.

Duload appears as a Windows executable written in Visual Basic either 18432 bytes or, in its compressed form, 7680 bytes in size.

If the infected file is accidentally opened “Duload” copies itself to the Windows system directory under the name “SystemConfig.exe” and modifies the system registry so that this file automatically loads each time Windows is started.

Next, the Duload worm creates a folder in the Windows directory called “Media” and copies itself to this directory under 39 different names, explained in more detail in Kasperky’s advisory.

Duload then once again modifies the system registry in order to make the Media folder accessible to all other KaZaA network users, with the aim of furthering its spread.

One modification of the worm also downloads from the Net several Trojan programs designed to establish the unauthorised remote management of victim computers.

Antivirus vendors are in the process of updating their tools to detect the worm.

Related

1. KWBot worm hits KaZaA
2. New worm/Trojan: Kazoa.C Spreading fast thourgh Kazaa and IRC
3. Worm targets P2P
4. KaZaa users warned of p2p worm
5. W32.Benjamin.Worm on KaZaA