|
|
Worm.Hwbot.A Worm Information
| Name: |
Worm.Hwbot.A |
| Category: |
Worm |
| Alias: |
- Alias: Bat/zz99, VBS/Generic@MM |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
Worm.Hwbot.A is a network worm with IRC backdoor functionaility.
Worm.Hwbot.A copies itself to the Windows system folder with the filename HWCLOCK.EXE and creates a service with the following characteristics so as to run itself on system startup:
Service Name: hwclock
Display Name: Hardware Clock Driver
Service Description: Enables a computer to save and restore system time information using the hardware clock. Stopping or disabling this service will result in system instability.
W32/Hwbot-A sets the following entries in the registry:
HKLMsoftwaremicrosoftole enabledcom = "n"
HKLMsystemcurrentcontrolsetcontrollsa
restrictanonymous = "1"
Worm.Hwbot.A attempts to create a read-only file called DCPROMO.LOG in the DEBUG subfolder of the Windows folder to patch against certain network vulnerabilities.
Worm.Hwbot.A connects to an IRC server and waits for instructions from a remote user. Possible instructions include downloading and execute further code or to spreading via network secruity exploits.
|
| Signatures:
|
process: hwclock.exe: MD5 Hash: dc73bfa4d78284155dd.. |
| Type: |
Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do). |
Top Worm Visited Pages:
Wukill.mstray - Alias: Win32/HLLW.Wukill - 288 visits
Rbot - Alias: Backdoor.Rbot.Gen - 275 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 228 visits
Trojan.Downloader.winstall - 181 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 89 visits
Worm.P2P.SpyBot.gen - 56 visits
Gaobot - 43 visits
Win32/Darby.O - 42 visits
Worm.Trilissa.e - 42 visits
JS.Lame - Alias: HTML.Lame - 40 visits
Random Worm Pages:
Worm.Fog.c
Email-Worm.Win32.Gibe.a
Annoying Worm - Alias: I-Worm.Newpic.a, W32/Choke, W32/Choke.C
Worm.Mimail.h
Worm.MTX.a
IRC.Worm.FreePorn
IRC.Worm.Spth.Phile.a
VBS.e-Gen.b - Alias: vbs.phram.b
Worm.Bropia.P - Alias: Win32/Bropia.P.worm
VBE.Ethereal - Alias: Bat/zz99, VBS/Generic@MM
|
|
