high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Protection available since | 16 November 2005 01:42:16 (GMT) |
| Last updated | 21 November 2005 12:47:38 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Doxpar-D is a network worm with password stealing capabilities.
W32/Doxpar-D spreads to other network computers by exploiting common buffer
overflow vulnerabilities, including: LSASS (MS04-011).
W32/Doxpar-D will spy on a user's internet access and attempt to steal banking
related details. The worm will attempt to terminate certain security-related
services.
When first run W32/Doxpar-D copies itself to <System>\<random>.exe and creates
the following files:
\boot.sys
<System>\<random filename>.dll
The file boot.sys is detected by Sophos's anti-virus products as Troj/Padodor-Y
and the file <random filename>.dll is detected Sophos's anti-virus products as
W32/Doxpar-C.
The following registry entry is created to run code exported by the worm
library on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
DBGA0EEG
{6C7F7D05-2430-7FA8-28C5-2F9036BF28AF}
The file <random filename>.dll is registered as a COM object, creating registry
entries under:
HKCR\CLSID\{6C7F7D05-2430-7FA8-28C5-2F9036BF28AF}
|
