W32/Spybot-BX

Please follow the instructions for removing worms.

Change any data that may have become compromised.

Renaming the registry editor

• Using Windows explorer, browse to the Windows folder (usually C:\Windows or C:\Winnt) right-click Regedit.exe and make a copy of it.
• Rename the copy of Regedit.exe to Regedit.com.
• At the taskbar, click Start|Run. Type 'Regedit.com' and press Return. The registry editor opens.

In Windows NT/2000/XP/2003 you will also need to edit the following registry entries. The removal of these entries is optional in Windows 95/98/Me. Please read the warning about editing the registry.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winsock2 driver = WINUPDATE.EXE

and delete it if it exists.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\RunOnce\Winsock2 driver = WINUPDATE.EXE

and delete it if it exists.

Close the registry editor and reboot your computer.

W32/Spybot-BX is a peer-to-peer (P2P) worm with backdoor Trojan functionality.

W32/Spybot-BX attempts to move itself to WINUPDATE.EXE in the Windows System folder and creates entries in the registry at the following locations to run itself on system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Winsock2 driver = WINUPDATE.EXE

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Winsock2 driver = WINUPDATE.EXE

W32/Spybot-BX copies itself to a folder called KAZAABACKUPFILES in the Windows System folder with the following filenames:

5 sluts rape willing male.exe
AquaNox2 Crack.exe
AVP_Crack.exe
Battlefield1942_bloodpatch.exe
CableModem-Uncapper(Surfboard all versions).exe
counterstrike(Wallhack).exe
divx-encoder.exe
FIFA2003 crack.exe
Janet-Superbowl-tittys.exe
MS-Office-XP-Keygen.exe
NBA2003_crack.exe
Osama Video.exe
PingPong.exe
RegionFree-DVD-Fix.exe
Unreal2_bloodpatch.exe
UT2003_bloodpatch.exe
UT-2003-noserial.exe
Virtual-3d-sex.exe
WinXP-Keygen(WorkswithSP1a).exe
zoneallarm_pro_crack.exe

W32/Spybot-BX then sets the following registry entry to enable sharing of these files with KaZaA:

HKCU\Software\Kazaa\LocalContent\
Dir0 = 012345:C:\\kazaabackupfiles\

W32/Spybot-BX also attempts to copy itself to the startup folder of attached network drives and can be used to record the keystrokes on the compromised machine, effectively acting as a keylogger. This worm can also be used to
initiate SYNFlood attacks.

W32/Spybot-BX remains resident, running in the background as a service
process and listening for commands from remote users via IRC channels.

W32/Spybot-BX attempts to terminate various monitoring programs including the following:

'NETSTAT.EXE'
'TASKMGR.EXE'
'MSCONFIG.EXE'
'REGEDIT.EXE'.