W32/Kidala-B is a mass-mailing worm and IRC backdoor Trojan for the Windows
platform.
W32/Kidala-B spreads:
- via file sharing on P2P networks
- to other network computers infected with: Troj/Kuang, Troj/Sub7, W32/Sasser, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (ms04-011)
(CAN-2003-0719), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), MSSQL
(MS02-039) (CAN-2002-0649) and PNP (MS05-039)
W32/Kidala-B is a mass-mailing worm and IRC backdoor Trojan for the Windows
platform.
W32/Kidala-B spreads:
- via file sharing on P2P networks
- to other network computers infected with: Troj/Kuang, Troj/Sub7, W32/Sasser,
Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (ms04-011)
(CAN-2003-0719), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), MSSQL
(MS02-039) (CAN-2002-0649) and PNP (MS05-039)
When first run W32/Kidala-B copies itself to:
\My Downloads\YahooMessenger_Loader.scr
<Program Files>\KaZaA\My Shared Folder\icq2006-final.bat
<Program Files>\eDonkey2000\Incoming\Angilina_Jolie_Sucks_a_Dick.scr
<System>\Swords.exe
and creates the file <Temp>\remove.bat.
The following registry entry is created to run Swords.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Blacky
<System>\Swords.exe