WORM_IRCBOT.JSB

This worm drops copies of itself into all the removable drives connected to an affected system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Installation

This worm drops the following files:

• %System Root%\DATA\SYSTEM\Desktop.ini

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System Root%\DATA\SYSTEM\Xp.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects itself into the following processes as part of its memory residency routine:

• EXPLORER.EXE

Autostart Technique

This worm creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{67KLN5J0-4OPM-00WE-AAX5-74KC2A323342}
StubPath = "%System Root%\DATA\SYSTEM\Xp.exe"

Propagation

This worm drops copies of itself into all the removable drives connected to an affected system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.