Quote:
The second malicious code, Duster.B, is a virus with the characteristics of a worm that spreads through the P2P file sharing program KaZaA and across network shares. It does this following the routines below:
- Through KaZaA
Duster.B looks for the default shared folder of this file sharing program. If this folder is not shared, it modifies an entry in the Windows Registry in order to share it. Then, it infects all the PE files it finds in the shared folder by adding its code to the beginning of them. When other users access these files remotely, they will download the files infected by Duster.B, thinking that they are useful computer programs, images, etc. However, when they run the downloaded file, their computers will also be infected by Duster.B.
- Across network shares.
Duster.B checks if the infected computer belongs to a network and if it is, it tries to copy the file DUST.EXE to all the network computers and creates a file called AUTOEXEC.BAT on each one. The aim of this file is to run the virus every time the computer is started.
Duster.B connects to the IP address 208.178.231.190, which belongs to an IRC server, through port 6667. After it has done this, it waits for control commands like download and run files.
RRP