I-Worm.Roron

Worm Roron is a very dangerous spyware that spreads mostly by e-mail. It comes in letters with infected attachments. When a user executes such attachment, the worm installs itself to the computer and starts its spreading routine. It sends infected messages written in Bulgarian or English to e-mail addresses found in a computer. It places its files to shared folders of the KaZaA peer-to-peer client and infects all found shared disks. It also has an integrated IRC trojan, which can be used by attackers to control your computer remotely via the IRC network. The worm has a dangerous payload: it terminates some antivirus and security-related applications and twice per month tries to remove all files on all hard disks. It also can defend itself from removal: if a user removes several its files, the worm erases all the data.