high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Protection available since | 17 August 2005 00:35:15 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Esbot-A is a worm and IRC backdoor Trojan for the Windows platform.
W32/Esbot-A spreads to other network computers by exploiting common buffer overflow vulnerabilites, including LSASS (MS04-011) and PnP (MS05-039).
W32/Esbot-A will connect to an IRC channel and wait for instructions. The Trojan component has the ability to do the following:
Download and Execute files
Execute DDoS attacks using a variety of methods
Search for files on the infected computer
When first run W32/Esbot-A copies itself to
The file mousesync.exe is registered as a new system driver service named "mousesync", with a display name of "Mouse Synchronization" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\mousesync\
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
n
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Patch for the operating system vulnerability exploited by W32/Esbot-A can be obtained from Microsoft at:
|
