W32/Spybot-NX is a worm for the Windows platform with IRC backdoor functionality.
W32/Spybot-NX is a worm for the Windows platform with IRC backdoor functionality.
W32/Spybot-NX installs as ajsha5.exe in the <System> folder. The following Registry entries are added to run at startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
(default)
ajsha5.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(default)
ajsha5.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
(default)
ajsha5.exe
Once running, W32/Spybot-NX attempts to connect to a remote server (port 3921) to receive remote commands.