W32/Delbot-I is an IRC worm with backdoor functionality which allows a remote intruder to gain access and control over the computer.
W32/Delbot-I spreads to other network computers by scanning network shares for weak passwords and by exploiting common buffer overflow vulnerabilities, including Symantec (SYM06-010).
W32/Delbot-I is an IRC worm with backdoor functionality which allows a remote intruder to gain access and control over the computer.
W32/Delbot-I spreads to other network computers by scanning network shares for weak passwords and by exploiting common buffer overflow vulnerabilities, including Symantec (SYM06-010).
When first run W32/Delbot-I copies itself to <System>\resvs.exe.
The following registry entry is created to run resvs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Service
System\resvs.exe