An IRC bot. It spreads by copying itself with the RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb_driver.com name to removable media. In the root folder, the bot creates the autorun.inf file.
Then it looks for SandboxStarter, tcpview, procmon, and filemon processes by referring to HKEY_PERFORMANCE_DATA.
The malicious program replicates itself to %windir%\csrs.exe and modifies the following registry branches to ensure its own autorun:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\and
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\The bot registers itself with the Windows Services name. Then it modifies the firewall settings to be able to access the network.
The malware can send out spam messages over IM networks, download and run files, and launch DDoS attacks.
