・W32/Darker.worm!p2pは、以下の条件でMcAfee製品を使用すると、New Malware.b、またはNew BackDoor（個別のワーム名ではなく、総称です）として検出されます。
- 4.2.40以降のスキャンエンジンを使用する
- 定義ファイル4245〜4302を使用する
- プログラムヒューリスティックを有効にする
- 圧縮ファイルのスキャンを有効にする（デフォルトの設定）
・W32/Darker.worm!p2pは、よく利用されるピアツーピアアプリケーションを介して繁殖します。また、IRC（Internet Relay Chat）ボットとして機能し、リモート攻撃者からのコマンドを受信します。
・W32/Darker.worm!p2pが実行されると、WINDOWSディレクトリにsvchost.exeというファイル名で自身をコピーします。以下のレジストリ実行キーを作成して、システムの起動時に自身を読み込みます。
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run "ServiceProcess" = C:\WINDOWS\svchost.exe
・IRCサーバ（gotroot.darktech.org）に接続して特定のチャネルに参加し、コマンドを待ちます。リモート攻撃者は、コマンドを介して以下のようなさまざまなタスクを実行できます。
- ping
- IRC機能
- ファイルの検索、削除、ダウンロード、実行
- 内部プロキシサーバの設定
- ウイルス対策プロセスの終了
- 電子メールを介した繁殖
- サービス拒否攻撃の開始
・リモート攻撃者の指示を受けると、W32/Darker.worm!p2pは電子メールフォルダにある電子メールアドレスにMAPIで以下のメッセージを送信します。
件名： Microsoft Windows OutLook Express urgent updates
本文： There is a new virus spreading called Win32.darkirc virus. This email was sent to you as a precaution as ur version of OutLook Express has not been updated. Patch available attached to the email
添付フィル： Av_patch.exe
・リモート攻撃者の指示を受けると、実行中の以下のプロセスを終了できます。
- ACKWIN32.EXE
- ADVXDWIN.EXE
- AGENTSVR.EXE
- AHNSD.EXE
- ALERTSVC.EXE
- ALOGSERV.EXE
- AMON9X.EXE
- ANTI-TROJAN.EXE
- ANTIVIRUS.EXE
- ANTS.EXE
- APIMONITOR.EXE
- APLICA32.EXE
- APVXDWIN.EXE
- ATCON.EXE
- ATGUARD.EXE
- ATRO55EN.EXE
- ATUPDATER.EXE
- ATWATCH.EXE
- AUPDATE.EXE
- AUTODOWN.EXE
- AUTODOWN.exe
- AUTOTRACE.EXE
- AUTOUPDATE.EXE
- AVCONSOL.EXE
- AVGCC32.EXE
- AVGCTRL.EXE
- AVGSERV.EXE
- AVGSERV9.EXE
- AVGW.EXE
- AVKPOP.EXE
- AVKSERV.EXE
- AVKSERVICE.EXE
- AVKWCL9.EXE
- AVKWCTL9.EXE
- AVP.EXE
- AVP32.EXE
- AVPCC.EXE
- AVPEXEC.EXE
- AVPINST.EXE
- AVPM.EXE
- AVPUPD.EXE
- AVRESCUE.EXE
- AVSYNMGR.EXE
- AVSYNMGR.exe
- AVWINNT.EXE
- AVXMONITOR9X.EXE
- AVXMONITORNT.EXE
- AVXQUAR.EXE
- AVXQUAR.EXE.EXE
- AVXW.EXE
- AckWin32.exe
- Alerter
- AutoDown.exe
- AutoTrace.exe
- AvSynMgr
- AvgServ
- Avgctrl.exe
- AvkServ.exe
- Avsched32.exe
- BD_PROFESSIONAL.EXE
- BIDEF.EXE
- BIDSERVER.EXE
- BIPCP.EXE
- BIPCPEVALSETUP.EXE
- BISP.EXE
- BLACKD.EXE
- BLACKICE.EXE
- BOOTWARN.EXE
- BORG2.EXE
- BS120.EXE
- BlackICE.exe
- CDP.EXE
- CFGWIZ.EXE
- CFIADMIN.EXE
- CFIAUDIT.EXE
- CFINET.EXE
- CFINET32.EXE
- CLAW95.EXE
- CLAW95CF.EXE
- CLEAN.EXE
- CLEANER.EXE
- CLEANER3.EXE
- CLEANPC.EXE
- CMGRDIAN.EXE
- CMON016.EXE
- CONNECTIONMONITOR.EXE
- CPD.EXE
- CPDCLNT.EXE
- CPDClnt.exe
- CPF9X206.EXE
- CPFNT206.EXE
- CSINJECT.EXE
- CSINSM32
- CSS 1631.EXE
- CTRL.EXE
- CV.EXE
- CWNB181.EXE
- CWNTDWMO.EXE
- Claw95.exe
- Claw95cf.exe
- DEFSCANGUI.EXE
- DEFWATCH.EXE
- DEPUTY.EXE
- DOORS.EXE
- DPF.EXE
- DRWATSON.EXE
- DRWEB32.EXE
- DVP95.EXE
- DVP95_0.EXE
- EFPEADM.EXE
- EFPEADM.exe
- ENT.EXE
- ESCANH95.EXE
- ESCANHNT.EXE
- ESCANV95.EXE
- ETRUSTCIPE.EXE
- ETRUSTCIPE.exe
- EVPN.EXE
- EVPN.exe
- EXANTIVIRUS-CNET.EXE
- EXPERT.EXE
- F-AGNT95.EXE
- F-PROT.EXE
- F-PROT95.EXE
- F-STOPW.EXE
- FAMEH32.EXE
- FAST.EXE
- FCH32.EXE
- FIH32.EXE
- FIREWALL.EXE
- FIX-IT.EXE
- FLOWPROTECTOR.EXE
- FNRB32.EXE
- FP-WIN.EXE
- FP-WIN_TRIAL.EXE
- FRW.EXE
- FSAA.EXE
- FSAV.EXE
- FSAV32.EXE
- FSAV530STBYB.EXE
- FSAV530WTBYB.EXE
- FSAV95.EXE
- FSAVE32.EXE
- FSGK32.EXE
- FSM32.EXE
- FSMA32.EXE
- FSMB32.EXE
- FWENC.EXE
- GBMENU.EXE
- GBPOLL.EXE
- GENERICS.EXE
- GUARD.EXE
- GUARDDOG.EXE
- HACKTRACERSETUP.EXE
- HTLOG.EXE
- HWPE.EXE
- IAMAPP.EXE
- IAMSERV.EXE
- IAMSTATS.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- ICSUPPNT.EXE
- IFACE.EXE
- IFW2000.EXE
- IOMON98.EXE
- IPARMOR.EXE
- IRIS.EXE
- ISRV95.EXE
- JAMMER.EXE
- JEDI.EXE
- KAVLITE40ENG.EXE
- KAVPERS40ENG.EXE
- KERIO-PF-213-EN-WIN.EXE
- KERIO-WRL-421-EN-WIN.EXE
- KERIO-WRP-421-EN-WIN.EXE
- KILLPROCESSSETUP161.EXE
- LDNETMON.EXE
- LDPRO.EXE
- LDPROMENU.EXE
- LDSCAN.EXE
- LOCALNET.EXE
- LOCKDOWN.EXE
- LOCKDOWN2000.EXE
- LSETUP.EXE
- LUALL.EXE
- LUAU.EXE
- LUCOMSERVER.EXE
- LUINIT.EXE
- LUSPT.exe
- MCAGENT.EXE
- MCMNHDLR.EXE
- MCSHIELD.EXE
- MCTOOL.EXE
- MCUPDATE.EXE
- MCVSRTE.EXE
- MCVSSHLD.EXE
- MFW2EN.EXE
- MFWENG3.02D30.EXE
- MGAVRTCL.EXE
- MGAVRTE.EXE
- MGHTML.EXE
- MGUI.EXE
- MINILOG.EXE
- MONITOR.EXE
- MONSYS32.EXE
- MONSYSNT.EXE
- MONWOW.EXE
- MOOLIVE.EXE
- MPFAGENT.EXE
- MPFSERVICE.exe
- MPFTRAY.EXE
- MRFLUX.EXE
- MSINFO32.EXE
- MSSMMC32.EXE
- MU0311AD.EXE
- MWATCH.EXE
- MWATCH.exe
- MXTASK.EXE
- Mcshield.exe
- Monitor.exe
- NAV Auto-Protect
- NAV80TRY.EXE
- NAVAP
- NAVAPSVC.EXE
- NAVAPW32.EXE
- NAVDX.EXE
- NAVENG
- NAVENGNAVEX15
- NAVEX15
- NAVLU32.EXE
- NAVRUNR.EXE
- NAVSTUB.EXE
- NAVW32.EXE
- NAVWNT.EXE
- NC2000.EXE
- NCINST4.EXE
- NDD32.EXE
- NEOMONITOR.EXE
- NEOWATCHLOG.EXE
- NETARMOR.EXE
- NETINFO.EXE
- NETMON.EXE
- NETSCANPRO.EXE
- NETSPYHUNTER-1.2.EXE
- NETSTAT.EXE
- NETUTILS.EXE
- NISSERV.EXE
- NISUM.EXE
- NMAIN.EXE
- NORMIST.EXE
- NORTON_INTERNET_SECU_3.0_407.EXE
- NPF40_TW_98_NT_ME_2K.EXE
- NPFMESSENGER.EXE
- NPROTECT.EXE
- NPSSVC.EXE
- NSCHED32.EXE
- NTVDM.EXE
- NTXCONFIG.EXE
- NTXconfig.exe
- NUI.EXE
- NVARCH16.EXE
- NVC95.EXE
- NVLAUNCH.EXE
- NVSVC32
- NWINST4.EXE
- NWSERVICE.EXE
- NWService.exe
- NWTOOL16.EXE
- Navw32.exe
- NeoWatchLog.exe
- Nui.EXE
- Nupgrade.exe
- OFFGUARD.EXE
- OSTRONET.EXE
- OUTPOST.EXE
- OUTPOSTINSTALL.EXE
- OUTPOSTPROINSTALL.EXE
- PADMIN.EXE
- PANIXK.EXE
- PAVPROXY.EXE
- PCC2002S902.EXE
- PCC2K_76_1436.EXE
- PCCCLIENT.EXE
- PCCGUIDE.EXE
- PCCIOMON.EXE
- PCCNTMON.EXE
- PCCPFW
- PCCWIN97.EXE
- PCCWIN98.EXE
- PCDSETUP.EXE
- PCFWALLICON.EXE
- PCIP10117_0.EXE
- PCSCAN.EXEPDSETUP.EXE
- PERISCOPE.EXE
- PERSFW.EXE
- PERSWF.EXE
- PF2.EXE
- PFWADMIN.EXE
- PINGSCAN.EXE
- PLATIN.EXE
- POP3TRAP.EXE
- POPROXY.EXE
- POPSCAN.EXE
- PORTDETECTIVE.EXE
- PORTMONITOR.EXE
- PPINUPDT.EXE
- PPTBC.EXE
- PPVSTOP.EXE
- PROCESSMONITOR.EXE
- PROCEXPLORERV1.0.EXE
- PROGRAMAUDITOR.EXE
- PROPORT.EXE
- PROTECTX.EXE
- PSPF.EXE
- PURGE.EXE
- PVIEW95.EXE
- QCONSOLE.EXE
- QSERVER.EXE
- RAV7.EXE
- RAV7WIN.EXE
- RAV8WIN32ENG.EXE
- REALMON.EXE
- RESCUE.EXE
- RESCUE32.EXE
- RRGUARD.EXE
- RSHELL.EXE
- RTVSCN95.EXE
- RULAUNCH.EXE
- Rescue.exe
- SAFEWEB.EXE
- SBSERV.EXE
- SCAN32.EXE
- SCHEDAPP.EXE
- SCRSCAN.EXE
- SD.EXE
- SETUPVAMEEVAL.EXE
- SETUP_FLOWPROTECTOR_US.EXE
- SFC.EXE
- SGSSFW32.EXE
- SH.EXE
- SHELLSPYINSTALL.EXE
- SHN.EXE
- SMC.EXE
- SOFI.EXE
- SPF.EXE
- SPHINX.EXE
- SPYXX.EXE
- SRWATCH.EXE
- SS3EDIT.EXE
- ST2.EXE
- SUPFTRL.EXE
- SUPPORTER5.EXE
- SWEEP95.EXE
- SWEEPSRV.SYS
- SWNETSUP.EXE
- SYMPROXYSVC.EXE
- SYMTRAY.EXE
- SYSDOC32.EXE
- SYSEDIT.EXE
- Sphinx.exe
- SweepNet
- SymProxySvc.exe
- TASKMON.EXE
- TAUMON.EXE
- TAUSCAN.EXE
- TC.EXE
- TCA.EXE
- TCM.EXE
- TDS-3.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- TFAK.EXE
- TFAK5.EXE
- TGBOB.EXE
- TITANIN.EXE
- TITANINXP.EXE
- TRACERT.EXE
- TRJSCAN.EXE
- TRJSETUP.EXE
- TROJANTRAP3.EXE
- Tmntsrv
- UNDOBOOT.EXE
- UPDATE.EXE
- Uh`S@d
- VBCMSERV.EXE
- VBCONS.EXE
- VBUST.EXE
- VBWIN9X.EXE
- VBWINNTW.EXE
- VCCMSERV.EXE
- VCSETUP.EXE
- VET32.EXE
- VET32.exe
- VET95.EXE
- VETTRAY.EXE
- VFSETUP.EXE
- VIR-HELP.EXE
- VIRUSMDPERSONALFIREWALL.EXE
- VNLAN300.EXE
- VNPC3000.EXE
- VPC32.EXE
- VPC42.EXE
- VPFW30S.EXE
- VPTRAY.EXE
- VSCENU6.02D30.EXE
- VSCHED.EXE
- VSECOMR.EXE
- VSHWIN32.EXE
- VSISETUP.EXE
- VSMAIN.EXE
- VSMON.EXE
- VSSTAT.EXE
- VSWIN9XE.EXE
- VSWINNTSE.EXE
- VSWINPERSE.EXE
- VVSTAT.EXE
- VbCons.exe
- Vet95.exe
- VetTray.exe
- W32DSM89.EXE
- W9X.EXE
- WATCHDOG.EXE
- WEBSCANX.EXE
- WEBTRAP.EXE
- WGFE95.EXE
- WHOSWATCHINGME.EXE
- WIMMUN32.EXE
- WINRECON.EXE
- WINROUTE
- WINSFCM.EXE
- WNT.EXE
- WRADMIN.EXE
- WRCTRL.EXE
- WSBGATE.EXE
- WYVERNWORKSFIREWALL.EXE
- WrAdmin.exe
- WrCtrl.exe
- XPF202EN.EXE
- ZAPRO.EXE
- ZAPSETUP3001.EXE
- ZATUTOR.EXE
- ZAUINST.EXE
- ZONALM2601.EXE
- ZONEALARM.EXE
- _AVP32.EXE
- _AVPCC.EXE
- _AVPM.EXE
- agentw.exe
- alogserv.exe
- apvxdwin.exe
- avkpop.exe
- avkservice.exe
- avkwctl9.exe
- avpm.exe
- blackd.exe
- ccApp.exe
- ccEvtMgr.exe
- ccPxySvc.exe
- cfgWiz.exe
- cleaner.EXE
- cleaner3.EXE
- cpd.exe
- defalert.exe
- defscangui.exe
- f-stopw.exe
- fameh32.exe
- fch32.exe
- fih32.exe
- fnrb32.exe
- fsaa.exe
- fsav32.exe
- fsgk32.exe
- fsm32.exe
- fsma32.exe
- fsmb32.exe
- gbmenu.exe
- gbpoll.exe
- iamapp.exe
- iamserv.exe
- lockdown2000.exe
- navapsvc
- navapsvc.exe
- netstat.exe
- notstart.exe
- npscheck.exe
- ntrtscan.EXE
- nvapsvc
- pathping.exe
- pavproxy.exe
- pccntmon.EXE
- pccwin97.EXE
- pcscan.EXE
- ping.exe
- rapapp.exe
- route.exe
- routemon.exe
- sbserv.exe
- sharedaccess
- tracerpt.exe
- tracert.exe
- vbcmserv.exe
- vsmon.exe
- zapro.exe
- zonealarm.exe
