P2P-Worm.Win32.Irkaz

Technical Details

This primitive, harmless virus is a Windows PE EXE file, written in C. It is 6176 bytes in size.

When lanching it copies itself to the Windows system directory and registers a file named netdll32 to the following registry keys:

[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
     [HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices]

If the Kazaa P2P network is accessible, the worm will copy itself to the network under the name:

     sex_xxx_teen_porn_teen_sex.jpg.exe

It will change the Internet Explorer home page.