Worm warning: Another little wriggler plagues Kazaa

By Graeme Wearden

Users of file-swapping service Kazaa have been warned about a new worm that could put their computers under the remote control of hackers.

Anti-virus firm Kaspersky Labs said on Thursday that it had detected the worm, called Duload, spreading across the Kazaa network. This is at least the third worm to hit the Kazaa network, following KWBot last month and May's Benjamin worm.

Duload is a Windows attachment written in visual basic, Kaspersky said. Like KWBot and Benjamin, Duload spreads by modifying the infected computer's system registry and then disguising multiple copies of itself as files that other Kazaa users might like to download.

The first time that Duload is run, it copies itself to the Windows system directory under the name "Systemconfig.exe", and edits the system registry so that it is automatically run whenever Windows is loaded.

Duload then creates a folder called Media, and makes 39 copies of itself. It uses names such as Free Porn.exe, Win An Xbox.exe, Soldier Of Fortune 2 Mutiplayer Serial Hack.exe and Britney Spears Dance Beat.exe.

By then making the Media folder accessible to other Kazaa users, Duload sets up the conditions necessary for it to spread across the Kazaa network.

Two versions of Duload have been detected - Worm.P2P.Duload.a and Worm.P2P.Duload.b. Kaspersky said it has recorded instances of the worm in Italy.

Kaspersky has also warned that Duload.a, when activated, also downloads several Trojan programs that could compromise the victim's computer, laying it open to unauthorised remote management.

A computer infected by a Trojan can be employed by a malicious hacker to take part in a Denial of Service attack.

Kaspersky has added a defence against Duload to its anti-virus database, which can be downloaded from the company's website, http://www.kaspersky.co.uk/download.html .

Graeme Wearden writes for ZDNet UK