11/25: Worm_Downad.A Arrives as Random .DLL File

Worm_Downad.A may be downloaded from remote sites by other malware. It may be dropped by other malware. It may arrive bundled with malware packages as a malware component.

It may arrive as a random .DLL file stored in the Windows system folder. It exports functions used by other malware.

It connects to certain Web sites to download possibly malicious files. It resolves the host name by attempting to obtain the machine's IP address by accessing certain URLs.

It waits for active Internet connection to access a certain URL where it downloads a copy of itself.

Technical details can be found at this Trend Micro page.