W32/Backzat-K

W32/Backzat-K
Aliases : I-Worm.BatzBack.i, WORM_BACKZAT.A

Type : Win32 worm

Description
W32/Backzat-K spreads via mIRC, AIM95 and the KaZaA file-sharing network.

Upon execution the worm copies itself as BatzBack.scr to the Windows and Windows System folders and sets the following registry entry with the path to
the copy in the Windows folder:

HKLM\Software\Microsoft\Windows\Current Version\Run\BatzBack

To spread through the KaZaA file-sharing network and AIM95 the worm attempts to copy itself as EnimEmSpearsBritney.scr and BuddyShare.exe to the KaZaA shared folder and Program Files\AIM95 respectively.

To spread through IRC the worm modifies or creates script.ini so that Batzback.scr is sent to other users who join the current channel.

http://www.sophos.com/virusinfo/analyses/w32backzatk.html

 

TrendMicro:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BACKZAT.A

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BACKZAT.A&VSect=T

 

See this DSLReports Thread: Trend Micro: WORM_BACKZAT.A