Win32/AutoRun.IRCBot.AK is a worm that spreads via removable media. It can be controlled remotely. It uses techniques common for rootkits. When executed, the worm copies itself into the following location: The worm creates the following file: Installs the following system drivers: In order to be executed on every system start, the worm sets the following Registry entry: The following Registry entries are created: The worm copies itself into the root folders of removable drives using the following name: The following file is dropped in the same folder: Thus, the worm ensures it is started each time infected media is inserted into the computer. The worm is sent data and commands from a remote computer or the Internet.

It communicates with the following server using IRC protocol: It can execute the following operations: The worm quits immediately if the user name is one of the following: The worm may set the following Registry entries: The performed data entry creates an exception in the Windows Firewall program.