|
Description:
This worm exploits certain vulnerabilities to propagate. It takes advantage of the following Windows vulnerabilities:
- Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
- IIS5/WEBDAV Buffer Overflow vulnerability
- RPC Locator Vulnerability
For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:
It also attempts to log on to systems using a list of user names and passwords. It drops a copy of itself into accessible machines.
This worm has backdoor capabilities. It executes commands sent in via Internet Relay Chat (IRC) and can be used to launch as denial of service attack against specified target sites.
It terminates certain antivirus processes and files dropped by other malware. It steals the CD keys of popular game applications.
It modifies the HOST file so that any access to specific antivirus Web sites is redirected to the local machine. It also terminates processes belonging to other malware.
This worm runs on Windows 2000 and XP.
For additional information about this threat, see:
Solution
Technical Details
Description created: May. 24, 2004 2:40:22 AM GMT -0800
Description updated: Jun. 25, 2004 4:21:45 PM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
