high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 13 December 2004 10:10:03 (GMT) |
| Last updated | 17 March 2005 04:12:30 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Wurmark-B drops and executes W32/Sdbot-SB.
When first run Troj/Wurmark-B attempts to terminate any running instance of one of the following applications and delete the corresponding file:
winit.exe
Ad-Aware.exe
msn7.exe
VB6.EXE
Nero_Updater.exe
iexplore.exe
Al-Xp.exe
NPROTECTER.EXE
Winzip.exe.
The Trojan then searches for the following files left behind by W32/Wurmark-A and deletes them:
attached.zip
ANSMTP.DLL
bszip.dll
uglym.jpg
If the Visual Basic library file msvbvm60.dll is not present on the system Troj/Wurmark-B attempts to download it from
http://tribolic.com/webminer/support/RegAll/Files/MSVBVM60.DLL.
Finally, the Trojan drops and executes W32/Sdbot-SB which copies itself to the file winprotect.exe in the Windows system folder.
|
