6/14: Spybot-CO Spreads via KaZaA Network
June 14, 2004

W32/Spybot-CO is a P2P worm that spreads via the KaZaA file sharing network. In order to be run automatically on system startup, the worm copies itself to a file named AUGMSG.EXE in the Windows system folder and sets the following registry entries to point to this file.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
augmsg=AUGMSG.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\ augmsg=AUGMSG.EXE

The worm creates the folder %system%\kazaabackupfiles and copies itself there using certain file names. View them and other information at Sophos page.