high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 2 March 2005 19:18:35 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Change any data that may have become compromised.
More Information
W32/Codbot-G is a network worm with backdoor functionality for the Windows platform.
W32/Codbot-G can spread to remote network shares protected by weak passwords and computers vulnerable to common exploits, including the RPC-DCOM (MS04-012) and Webdav (MS03-007) vulnerabilities.
W32/Codbot-G can be controlled by a remote attacker via the IRC network. The attacker can issue commands to download and run further malicious code, steal passwords and system information and sniff packets from the local network.
On NT-based versions of Windows (NT,2000,XP) the worm registers itself as a service process named "Notepad Assistent" with a displayname of "Activating the notepad common used library" and a start-type of automatic so that the worm is run on computer login. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Notepad Assistent
W32/Codbot-G also creates the following registry entries in order to run as a service process in safe mode:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Notepad Assistent
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Notepad Assistent
|
