W32/Maibot-A

Please follow the instructions for removing worms.

W32/Maibot-A is a worm for the Windows platform.

W32/Maibot-A may spread via the AOL Instant Messenger program.

W32/Maibot-A runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

When first run W32/Maibot-A copies itself to &llt;System>\lockx.exe and creates the
following files:

<System>\msdirectx.sys
<System>\svkp.sys
\xz.bat

The file xz.bat is detected as Troj/KillProc-A and the file msdirectx.sys is detected as Troj/NtRootK-F.

svkp.sys is a clean device driver.

The following registry entries are created to run lockx.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
freestyle
lockx.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
freestyle
lockx.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
freestyle
lockx.exe

The file SVKP.sys is registered as a new system driver service named "SVKP",
with a display name of "SVKP" and a startup type of automatic, so that it is
started automatically during system startup. Registry entries are created
under:

HKLM\SYSTEM\CurrentControlSet\Services\SVKP\

The file msdirectx.sys is registered as a new system driver service named
"msdirectx", with a display name of "msdirectx". Registry entries are created
under:

HKLM\SYSTEM\CurrentControlSet\Services\msdirectx\

The following registry entries are set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
StandardProfile
EnableFirewall
0