W32/Dropper.IAW Trojan

 Virus Information - W32/Dropper.IAW Trojan:

W32/Dropper.IAW is a trojan. The trojan will infect Windows systems.

The trojan arrives as an attachment to email messages spammed by another malware or a malicious user. It may also be dropped by other malware or downloaded unknowingly by a user upon visiting malicious Web sites.

Upon execution, the trojan copies the following files in Windows Temp\spoolsv folder:

a.reg
aliases.ini
com.mrc
control.ini
ident.txt
mirc.ico
mirc.ini
popups.txt
remote.ini
run.bat
servers.ini
spoolsv.exe
users.ini
xmas.jpg

The trojan modifies registry at the following locations:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Microsoft Agent
HKEY_CURRENT_USER\Software\mIRC