high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | December 2005 (4.00) |
| Protection available since | 3 November 2005 10:53:29 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please read the instructions for removing W32/Esbot-B.
More Information
W32/Esbot-B is a network worm and IRC backdoor Trojan for the Windows platform.
W32/Esbot-B will connect to an IRC channel and wait for instructions. W32/Esbot-B is a network worm and IRC backdoor Trojan for the Windows platform.
W32/Esbot-B will connect to an IRC channel and wait for instructions.
When first run W32/Esbot-B copies itself to <Windows>\services32.exe.
The file services32.exe is registered as a new system driver service named "Content List Management Sub System", with a display name of "services32" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Content List Management Sub System\
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
Melt
<pathname of the Trojan executable>
|
