W32/Esbot-B is a network worm and IRC backdoor Trojan for the Windows platform.
W32/Esbot-B will connect to an IRC channel and wait for instructions.
W32/Esbot-B is a network worm and IRC backdoor Trojan for the Windows platform.
W32/Esbot-B will connect to an IRC channel and wait for instructions.
When first run W32/Esbot-B copies itself to <Windows>\services32.exe.
The file services32.exe is registered as a new system driver service named "Content List Management Sub System", with a display name of "services32" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Content List Management Sub System\
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Melt
<pathname of the Trojan executable>