Worm:Win32/Phorpiex.M

Worm:Win32/Phorpiex.M is a worm that proliferates via malicious email messages, fixed drives and removable drives. Worm:Win32/Phorpiex.M allows a remote attacker to obtain access and control of the infected computer. When installed, Worm:Win32/Phorpiex.M makes system changes by adding potentially malicious files and making registry modifications. Worm:Win32/Phorpiex.M also adds the registry entry so that it can automatically run every time Windows is started. Worm:Win32/Phorpiex.M downloads a list of email addresses to send itself to from a certain web address. The web address is given by a remote cybercriminal connected to the corrupted PC via IRC. Worm:Win32/Phorpiex.M searches for existing drives with drive letters other than A: and B:. In these drives, Worm:Win32/Phorpiex.M sets all folders in the drive to hidden, system, and read-only. Worm:Win32/Phorpiex.M then creates shortcuts with the same file names similar to these folders. The shortcut file links to a copy of Worm:Win32/Phorpiex.M located in a separate hidden folder.