W32/Delbot-AI

Category: Viruses and SpywareProtection available since:17 Apr 2007 00:00:00 (GMT)
Type: Win32 wormLast Updated:17 Apr 2007 00:00:00 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Delbot-AI is an IRC worm with backdoor functionality which allows a remote intruder to gain access and control over the computer. W32/Delbot-AI is an IRC worm with backdoor functionality which allows a remote intruder to gain access and control over the computer.

W32/Delbot-AI includes functionality to download, install and run new software.

W32/Delbot-AI spreads to other network computers by:

-scanning network shares for weak passwords
-exploiting common buffer overflow vulnerabilities, including Symantec (SYM06-010).
- Microsoft Security Advisory (935964): Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution.

When first run W32/Delbot-AI copies itself to <System>\mdnex.exe. The following registry entry is created to run it on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft DNSx
<System>\mdnex.exe