This worm propagates via networks by attempting to drop a copy of itself in shared folders. It also generates IP addresses and attempts to drop a copy of itself into the target address' default shares, as follows:
If the share is inaccessible, it uses the following list of user names and passwords:
This worm connects to an IRC server and joins a specific channel, where it listens for commands coming from a remote malicious user. The following commands are executed locally on affected machines:
Change IRC server and channel, where malware connects to
Download and execute files
Flush DNS cache
Add or remove default network shares
Scan local area network for listening ports
Denial of Service Attack
This worm is capable initiating a distributed denial of service (DDoS) attack using the following methods:
This worm attempts to steal the CD keys of the following games:
Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.
Identifying the Malware Program
To remove this malware, first identify the malware program.
Scan your system with your Trend Micro antivirus product.
This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier.
Open Windows Task Manager. On Windows 98 and ME, press
CTRL+ALT+DELETE On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file(s) detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On systems running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions. If you were not able to terminate the malware process as described in the previous procedure, restart your system.
Editing the Registry
For detailed information about the registry and Registry Editor, refer to the following articles from Microsoft:
Users running other Windows versions can proceed with the succeeding procedure set(s).
Running Trend Micro Antivirus
Scan your system with Trend Micro antivirus and delete files detected as
To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's online virus scanner.