W32/Britney-B is a worm that spreads by copying itself to the A: drive as the file Britney.exe.
W32/Britney-B is a worm that spreads by copying itself to the A: drive as the file Britney.exe.
In order to be started automatically when Windows boots up W32/Britney-B may copy itself to the file c:\windows\system\user32.exe. and add a Run entry to the Win.ini file pointing to this file.
The worm also adds the registry entry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
pointing to this file.
In addition W32/Britney-B creates the text file C:\windows\system\User32.ini.