high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Protection available since | 15 March 2005 09:12:53 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Change any data that may have become compromised.
More Information
W32/Codbot-S is a network worm and IRC backdoor Trojan.
W32/Codbot-S can spread to remote network shares protected by weak passwords and to computers vulnerable to common exploits, including the RPC-DCOM (MS04-012) and Webdav (MS03-007) vulnerabilities. See:
http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx
W32/Codbot-S can be controlled by a remote attacker via the IRC network. The attacker can issue commands to download and run further malicious code, steal passwords and system information and sniff packets from the local network.
W32/Codbot-S copies itself to the Windows system folder with the filename "ulcdrsf.exe".
On NT-based versions of Windows (NT,2000,XP) the worm registers itself as a service process named "Ulead Service" with a displayname of "Ulead Sservice System Files" and a start-type of automatic so that the worm is run on computer login. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Ulead Systems
W32/Codbot-S also creates the following registry entries in order to run as a service process in safe mode:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ulead Systems
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ulead Systems
|
