high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 4 April 2005 21:44:59 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Tirbot-C is a network worm with backdoor Trojan functionality for the Windows platform.
The worm spreads to network computers vulnerable to the LSASS vulnerability (MS04-011) and through network shares protected by weak passwords.
A patch is available from Microsoft for the LSASS vulnerability exploited by W32/Tirbot-C:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
The backdoor component joins a predetermined IRC channel and awaits further commands from remote users. The backdoor component can then be instructed to perform the following:
take part in distributed denial of service (DDoS) attacks
upload/download files
execute files
serve as a proxy server
harvest information from the system registry
report file system information
list running processes
scan for the presence anti-virus software
When first run, W32/Tirbot-C copies itself to the Windows system folder as DDEsvr.exe and sets the following registry entry in order to run each time
a user logs on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Winsvr manager
"<Windows system folder>\DDEsvr.exe"
W32/Tirbot-C may also create the following registry entries:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
run
<blank>
HKLM\Software\Microsoft\Windows\CurrentVersion\SysTM\
Parms
<data>
|
