darkhell
fgr.bat
finger.ins
hema.exe
never.bat
s.c
too1.exe
man.bat (detected by Sophos Anti-Virus as Troj/Noshare-N)
The worm also installs the following files, which are not malicious:
a.q - a list of words
bd.exe - a utility used for hiding windows
dex.exe - a networking utility used for running processes on other computers
fhgh.cca - a text file containing a counter
kern.exe - a utility that lists running processes
Sys.exe - a copy of the mIRC chat client
x.xx - a text file containing a list of IP ranges
