high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 6 March 2005 14:37:27 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Codbot-I is a network worm and IRC backdoor Trojan.
W32/Codbot-I can spread to remote network shares protected by weak passwords and computers vulnerable to common exploits, including the RPC-DCOM (MS04-012) and Webdav (MS03-007) vulnerabilities. See:
http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx
W32/Codbot-I can be controlled by a remote attacker via the IRC network. The attacker can issue commands to download and run further malicious code, steal passwords and system information and sniff packets from the local network.
W32/Codbot-I copies itself to the Windows system folder with the filename "DXDLLSVC.EXE".
On NT-based versions of Windows (NT,2000,XP) the worm registers itself as a service process named "DirectX DLL" with a displayname of "DirectX DLL Register Support Service" and a start-type of automatic so that the worm is run on computer login. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\DirectX DLL
W32/Codbot-I also creates the following registry entries in order to run as a service process in safe mode:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DirectX DLL
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DirectX DLL
|
