W32/Delbot-P is a worm with IRC backdoor functionality for the Windows platform.
W32/Delbot-P spreads:
- to computers vulnerable to common exploits, including: Symantec (SYM06-010)
- to MSSQL servers protected by weak passwords
W32/Delbot-P runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Delbot-P is a worm with IRC backdoor functionality for the Windows platform.
W32/Delbot-P spreads:
- to computers vulnerable to common exploits, including: Symantec (SYM06-010)
- to MSSQL servers protected by weak passwords
W32/Delbot-P runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
When first run W32/Delbot-P copies itself to <System>\rst.exe.
The following registry entry is created to run rst.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Random Interface Network
System\rst.exe