WORM_AGENT.XSB

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It employs registry shell spawning so that it executes when files of certain types are run.

It modifies the system's HOSTS files to prevent users from accessing certain Web sites.

This worm propagates by dropping copies of itself in all removable drives. It then drops an AUTORUN.INF file to automatically execute the dropped copies when the said drives are accessed. The said AUTORUN.INF file contains certain strings.

Related Items