high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 27 March 2007 09:30:57 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/IrcWorm-A is an IRC worm for the Windows platform.
When W32/IrcWorm-A is installed the following files are created:
<Windows>\photo album.zip
<System>\rdfhost.dll
The worm will then attempt to connect to an IRC channel and begin sending messages enticing other users to accept the file transfer of zip file.
The following registry entry is created to run code exported by {5344BB88-3DE1-409F-8307-C85923A1F4DD} on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
rdshost
{5344BB88-3DE1-409F-8307-C85923A1F4DD}
The file rdfhost.dll is registered as a COM object, creating registry entries under:
HKCR\CLSID\{5344BB88-3DE1-409F-8307-C85923A1F4DD}
|
