The Solow worm spreads on flash drives

The Solow.B worm can spread fairly quickly on removable media, but does not cause significant damage to infected systems.

The Solow.B worm constantly monitors the drives connected to your PC as soon as it infects a computer. If it detects removable media in the system, such as a flash drive, it will immediately copy two files to it. One contains the worm's code, while the other ensures that the malware starts automatically when you insert the media into another computer.

The presence of Solow.B is indicated by the fact that the text in the title bar of the Internet Explorer window changes to the following: "TAGA LIPA ARE!"

When the Solow.B worm starts, it performs the following actions:

1. Create the following file:
% Windir% \ FS6519.dll.vbs

2. Locate and copy itself to the removable disk drives as follows:
[drive letter] \ FS6519.dll.vbs
[drive letter] \ autorun.inf

3. Create the following entry in the registration database:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentV ersion\Run”FS6519″ = “%Windir%\FS6519.dll.vbs”

4. Create the following entry in the registration database:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main”Window Title” = “TAGA LIPA ARE!”.