high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 17 May 2006 06:12:54 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Kidala-B is a mass-mailing worm and IRC backdoor Trojan for the Windows
platform.
W32/Kidala-B spreads:
- via file sharing on P2P networks
- to other network computers infected with: Troj/Kuang, Troj/Sub7, W32/Sasser, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (ms04-011)
(CAN-2003-0719), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), MSSQL
(MS02-039) (CAN-2002-0649) and PNP (MS05-039)
W32/Kidala-B is a mass-mailing worm and IRC backdoor Trojan for the Windows
platform.
W32/Kidala-B spreads:
- via file sharing on P2P networks
- to other network computers infected with: Troj/Kuang, Troj/Sub7, W32/Sasser,
Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS
(MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (ms04-011)
(CAN-2003-0719), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), MSSQL
(MS02-039) (CAN-2002-0649) and PNP (MS05-039)
When first run W32/Kidala-B copies itself to:
\My Downloads\YahooMessenger_Loader.scr
<Program Files>\KaZaA\My Shared Folder\icq2006-final.bat
<Program Files>\eDonkey2000\Incoming\Angilina_Jolie_Sucks_a_Dick.scr
<System>\Swords.exe
and creates the file <Temp>\remove.bat.
The following registry entry is created to run Swords.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Blacky
<System>\Swords.exe
|
