W32/QAZ.worm
This virus is reported to have brought a "large corporation" to its knees.
- TCP port 7597
- Renames Notepad.exe to Note.com
- Creates new Notepad.exe - correct size should be ~50 K, but corrupted
size ~120 K
- Registry key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\StartIE=C:\WINDOWS\notepad.exe qazwsx.hsq