W32/Zipwire-A is a peer-to-peer worm for the Windows platform that spreads using the LimeWire and FrostWire file sharing applications.
W32/Zipwire-A arrives as a zip archive containing a single file named Setup.exe, typically downloaded from the file sharing network.
W32/Zipwire-A contains a backdoor that connects to an IRC server and allows a remote user to access the computer.
W32/Zipwire-A creates a zipped copy of itself in <Windows>\Fonts\a.zip and shares it on the peer-to-peer network using the names of popular shared files.
W32/Zipwire-A obtains a list of potential filenames for copies of itself shared on the peer-to-peer network by downloading torrent listing pages from several BitTorrent tracking sites and parsing them for torrent filenames.
When first run W32/Zipwire-A copies itself to <Windows>\Fonts\svchost.exe and <Windows>\Fonts\Setup.exe and creates the following registry entry in order to run on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Host Process
<Windows>\Fonts\svchost.exe