high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 16 March 2005 08:56:10 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
and remove any reference to any file you deleted.
Close the registry editor.
More Information
W32/Poebot-J is a worm which attempts to spread to remote network shares with weak passwords.
The worm also contains backdoor functionality allowing unauthorised remote access to the infected computer via IRC channels.
W32/Poebot-J allows a remote attacker to steal internet account user names and passwords, download and execute files from the internet, flood other computers with network packets, retrieve system information and execute arbitrary commands by opening a remote shell on the infected computer.
When run, the worm moves itself to the Windows System folder as one of the following
filenames:
explorer.exe
firewall.exe
iexplore.exe
logon.exe
lssas.exe
spoolsvc.exe
winamp.exe
W32/Poebot-J also sets any of the following registry entries in order to run when a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Network Firewall
%SYSTEM%\firewall.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Local Security Authority Service
%SYSTEM%\lssas.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Logon Application
%SYSTEM%\logon.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Explorer
%SYSTEM%\explorer.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Internet Explorer
%SYSTEM%\iexplore.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Spooler SubSystem App
%SYSTEM%\spoolsvc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Winamp Agent
%SYSTEM%\winamp.exe
|
