W32.Fragl

This is a Microsoft Outlook worm with backdoor and pasword stealing features.

When this worm is executed, it does the following:

It creates the files:

• C:\Userdat.sys
• C:\System.dll

These are log files that the worm uses. It uses System.dll to log your keystrokes. This key logging feature can steal your username, password and other private, typed information.

The worm next creates the file \Windows\Winstart.bat.

It then creates copies of itself as:

• \Windows\Kernel32.ini
• \Windows\System\UserConf.exe

The worm also adds the value:

UserData     C:\Windows\System\UserConf.exe

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

This will run the worm every time that you start Windows.