Antivirus firm Kaspersky Labs has said that it had detected the worm, called Duload, spreading across the Kazaa network. This is at least the third worm to hit the Kazaa network, following KWBot last month and May's Benjamin worm.
Duload is a Windows attachment written in visual basic, Kaspersky said. Like KWBot and Benjamin, Duload spreads by modifying the infected computer's system registry and then disguising multiple copies of itself as files that other Kazaa users might like to download.
The first time that Duload is run, it copies itself to the Windows system directory under the name "Systemconfig.exe", and edits the system registry so that it is automatically run whenever Windows is loaded.
Duload then creates a folder called Media, and makes 39 copies of itself. It uses names such as Free Porn.exe, Win An Xbox.exe, Soldier Of Fortune 2 Mutiplayer Serial Hack.exe and Britney Spears Dance Beat.exe.
By then making the Media folder accessible to other Kazaa users, Duload sets up the conditions necessary for it to spread across the Kazaa network.
Two versions of Duload have been detected--Worm.P2P.Duload.a and Worm.P2P.Duload.b. Kaspersky said it has recorded instances of the worm in Italy.
Kaspersky has also warned that Duload.a, when activated, also downloads several Trojan programs that could compromise the victim's computer, laying it open to unauthorised remote management.
A computer infected by a Trojan can be employed by a malicious hacker to take part in a Denial of Service attack.
Kaspersky has added a defense against Duload to its Antivirus database, which can be downloaded from the company's Web site.
