W32.Azha.Worm

Printer Friendly Page

Discovered: November 24, 2003
Updated: November 26, 2003 4:33:54 PM
Systems Affected: Windows

W32.Azha.Worm is a worm that propagates by copying itself to various folders used by file-sharing clients.

Discovered: November 24, 2003
Updated: November 26, 2003 4:33:54 PM
Systems Affected: Windows

W32.Azha.Worm is a simple worm that propagates through peer to peer file-sharing networks. When the worm is executed, it creates the following copy of itself:
%System%\Azah.exe

In order to propagate through peer to peer networks, it creates the following copies of itself:
DirectX92a.ExE
Fairuz_Azah.ExE
FlashPlayer.ExE
IE62SETUP.ExE
mirc621.ExE
RealOnePlayerGold.ExE
TweakUI.ExE
VirusDefinitionUpdate.ExE
winamp320_std.ExE

These files are created in the following default shared folders of various peer to peer clients:
C:\Program Files\KMD\My Shared Folder
C:\Program Files\Gnucleus\downloads
C:\Program Files\Limewire\Shared
C:\Program Files\Bbearshare\Shared
C:\Program Files\ICQ\Shared Files
C:\Program Files\Winmx\Shared
C:\Program Files\Morpheus\My Shared Folder
C:\Program Files\Grokster\My Grokster
C:\Program Files\KaZaA Lite\My Shared Folder
C:\Program Files\KaZaA\My Shared Folder
C:\Program Files\eDonkey2000\Incoming