Malware type: Worm

Aliases: Backdoor.Win32.Katien.f (Kaspersky), W32/Cblade.worm.gen (McAfee), W32.Cblade.Worm (Symantec), BDS/Katien.F (Avira), Troj/Cblade-A (Sophos), Backdoor:Win32/Katien.F (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows

Encrypted: No

Description: 
This memory-resident Internet worm uses a known MS SQL 7 server vulnerability to propagate. The vulnerability allows the execution of a command shell on systems with the Systems Administrator account’s password set as empty by default.

This worm is also capable of performing a Distributed Denial of Service Attack (DDoS Attack) on target systems. It instructs the exploited MS SQL servers to connect to an IRC server to receive instructions from the attacker.

For additional information about this threat, see:
Solution
Technical Details

Description created: Nov. 22, 2001 5:19:19 PM GMT -0800
Description updated: Nov. 27, 2001 11:20:33 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.