W32/Maibot-A is a worm for the Windows platform.
W32/Maibot-A may spread via the AOL Instant Messenger program.
W32/Maibot-A runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.
When first run W32/Maibot-A copies itself to <System>\lockx.exe and creates the
following files:
<System>\msdirectx.sys
<System>\svkp.sys
\xz.bat
The file xz.bat is detected as Troj/KillProc-A and the file msdirectx.sys is
detected as Troj/NtRootK-F.
svkp.sys is a clean device driver.
The following registry entries are created to run lockx.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
freestyle
lockx.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
freestyle
lockx.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
freestyle
lockx.exe
The file SVKP.sys is registered as a new system driver service named "SVKP",
with a display name of "SVKP" and a startup type of automatic, so that it is
started automatically during system startup. Registry entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\SVKP\
The file msdirectx.sys is registered as a new system driver service named
"msdirectx", with a display name of "msdirectx". Registry entries are created
under:
HKLM\SYSTEM\CurrentControlSet\Services\msdirectx\
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy
StandardProfile
EnableFirewall
0