|
Worm.P2P.Lolol. Viruses Information
| Name: |
Worm.P2P.Lolol. |
| Category: |
Viruses |
| Description:
|
Details
Worm.P2P.Lolol.a
Lolol is a worm virus spreading via the Kazaa file sharing network.
The worm has a powerful backdoor routine which connects to an IRC channel where it accepts commands from its "master" (person controlling the worm).
The worm itself is a Windows PE EXE file about 60KB in length and written in Microsoft Visual C++.
When the infected file is run an installation routine.
Installation
While installing the worm copies itself to the Windows system directory under the name "syscfg32.exe" and registers this file in two system registry auto-run keys:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Configuration Loader = syscfg32.exe
HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices
Configuration Loader = syscfg32.exe
Spreading
The "Lolol" worm copies itself to the following directories:
C:program fileskazaamy shared folder C:program fileskazaa litemy shared folder
C:My Downloads
Following are names "Lolol" copies itself under:
play station emulator crack.exe
play station emulator.exe
warcraft 3 serials.pif
warcraft 3 crack.exe
100 free essays school.pif
aol password cracker.exe
aim password cracker
aol cracker.exe
aim cracker.exe
steal usernames.exe
how to hack.exe
divx pro.exe
how to use a shell.pif
Virtua Girl (Full).exe
worldbook.exe
GTA 3 Serial.exe
GTA 3 Crack.exe
gta3.exe
driver.exe
virtua girl - adriana.pif
virtua girl - bailey short skirt.pif
alle.t.c. (there is a total of about 80 different names). |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Sylwia.73
Mantra.71
Rikki famil
Win95.Werthe
Critter.101
Win32.Donu
Barcelon
Mehrgan.78
Config_Boot.
Dutch_Tiny.Wild.28
|
