Worm.Phorpiex.M

Worm:Win32/Phorpiex.M uses worm-based functions to distribute itself through both spam e-mail messages and removable drives, with its final payload including the compromise of any infected PC's security for the sake of allowing a remote attacker to gain control. Worm:Win32/Phorpiex.M may install other types of PC threats and will make specific efforts towards dismantling your computer's firewall security features. Since Worm:Win32/Phorpiex.M is both a worm and a backdoor Trojan, SpywareRemove.com malware experts rate Worm:Win32/Phorpiex.M as a high-level PC threat and encourage the isolation of your PC (to prevent Worm:Win32/Phorpiex.M from spreading), followed by removing Worm:Win32/Phorpiex.M with any suitably sophisticated brand of anti-malware product.

Why Worm:Win32/Phorpiex.M will not Look 'So Beautiful' On Your Hard Drive

Worm:Win32/Phorpiex.M's most identifiable distribution mechanism uses spam e-mail messages that are sent through already-compromised PCs in its botnet, with its probable targets including any e-mail addresses that can be harvested from these PCs. E-mails that carry Worm:Win32/Phorpiex.M disguise their ZIP-archived Worm:Win32/Phorpiex.M attachments as some form of personal photograph, with any of over a dozen tag lines used to make it look like a normal e-mail from an acquaintance. SpywareRemove.com malware researchers also warn that, even after Worm:Win32/Phorpiex.M is installed, Worm:Win32/Phorpiex.M will name some of its components to resemble Windows files, and can hide copies of itself by changing your file-viewing settings.

However, SpywareRemove.com malware researchers consider Worm:Win32/Phorpiex.M's primary attack its backdoor function, which lets criminals use an IRC-based C&C server to control your computer and send Worm:Win32/Phorpiex.M commands. With the appropriate instructions, Worm:Win32/Phorpiex.M may install other forms of malware, gather a limited amount of information about your PC, create firewall vulnerabilities via Registry changes or even uninstall itself.

Perhaps most importantly for SpywareRemove.com malware analysts like our own, Worm:Win32/Phorpiex.M also attempts to avoid being analyzed in sandbox-protected virtual environments. If Worm:Win32/Phorpiex.M is launched from within a VE machine, Worm:Win32/Phorpiex.M will terminate itself. Conveniently, any casual PC users also may use sandbox utilities to protect their PCs from Worm:Win32/Phorpiex.M and comparable PC threats.

Getting All Signs of the Worm:Win32/Phorpiex.M Infestation Out of the Way

Many worms also use local networks and removable hard drive (USB devices, etc.) to distribute themselves, and Worm:Win32/Phorpiex.M also abuses this well-defined worm strategy. If you're using a Worm:Win32/Phorpiex.M-infected PC, SpywareRemove.com malware experts heartily endorse the total prevention of any network or removable HD-based contact with other PCs until you've removed all copies of Worm:Win32/Phorpiex.M. Worm:Win32/Phorpiex.M will use basic file-viewing settings changes to conceal its copies and, whenever convenient, install itself on an uninfected computer automatically.

While Worm:Win32/Phorpiex.M is a generalized PC threat with broad attack functions (rather than the specific risks associated with specialized PC threats, such as a banking Trojan), the risks posed by a Worm:Win32/Phorpiex.M infection never should be underestimated. Competent and updated anti-malware applications always should be utilized for disinfecting Worm:Win32/Phorpiex.M, which will try to avoid being detected or deleted if at all possible.
Worm:Win32/Phorpiex.M's aliases include PWS-Zbot.gen.ary, Trojan.Win32.Jorik.IRCbot.waj, BackDoor.IRC.Bot.2232, Trojan-PWS.Win32.Fareit, Troj/IRCbot-AKR and WORM_PHORPIEX.JZ.

Technical Details