WORM_DORKBOT.N

This worm arrives via removable drives. It may be unknowingly downloaded by a user while visiting malicious websites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This worm arrives via removable drives.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following files:

• {removable drive}\recycler.lnk

It drops the following copies of itself into the affected system:

• {removable drive}\RECYCLER\{random}.exe

It creates the following folders:

• {removable drive}\RECYCLER

Download Routine

This worm connects to the following malicious URLs:

• ng.{BLOCKED}loan.com
• ng.{BLOCKED}ketbaby.com
• ng.{BLOCKED}allone.com
• ng.{BLOCKED}pperz11.com
• {BLOCKED}ousez11.com

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://{BLOCKED}i.{BLOCKED}nia.com