TrendLabs Malware Blog
Glossary
TrendWatch
TrendLabs Twitter
WORM_CODBOT.BF
Overview

Malware type: Worm

Aliases: Backdoor.Win32.Codbot.bq (Kaspersky), W32/Sdbot.worm.gen.l (McAfee), W32.IRCBot (Symantec), BDS/Codbot.BQ (Avira), Mal/IRCBot-B (Sophos),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows NT, 2000

Encrypted: No

Overall risk rating:


Reported infections:

Damage potential:

High

Distribution potential:

High

Infection Channel 1 : Propagates via network shares


Infection Channel 2 : Propagates via software vulnerabilities


Description: 

This worm spreads by dropping copies of itself in available network shares. It also takes advantage of the Windows vulnerabilities whose descriptions are found in the following Microsoft Web pages:

Using a random port, it connects to an Internet Relay Chat (IRC) server and joins a specific channel, where it listens for commands from a remote malicious user. The said commands are executed locally on affected machines. This routine compromises system security and opens the affected machine to further attacks.

For additional information about this threat, see:
Solution
Technical Details

Description created: Oct. 10, 2006 3:08:25 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.