|
|
Rdbot.suchost Worm Information
| Name: |
Rdbot.suchost |
| Category: |
Worm |
| Alias: |
- Alias: I-Worm.Recory.b, I-Worm.Recory.b |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
Rdbot.suchost has the ability to spread via network shares with weak passwords.
In order to run automatically when Windows starts up the worm copies itself as suchost.exe in the Windows system folder and adds the following registry entries to ensure the worm is run during windows logon:
HKCUSoftwareMicrosoftWindowsCurrentVersionRunAutomatic Microsoft Windows Updater = SUCHOST.EXE
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunAutomatic Microsoft Windows Updater = SUCHOST.EXE
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunServicesAutomatic Microsoft Windows Updater = SUCHOST.EXE
When run the worm attempts to connect to a remote IRC server. This connection is used as a control channel that allows a malicious user access to the infected computer.
|
| Signatures:
|
process: suchost.exe: MD5 Hash: b258b7acee3eccbd9c5.. |
| Type: |
Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do). |
Top Worm Visited Pages:
Wukill.mstray - Alias: Win32/HLLW.Wukill - 278 visits
Rbot - Alias: Backdoor.Rbot.Gen - 269 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 221 visits
Trojan.Downloader.winstall - 174 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 84 visits
Worm.P2P.SpyBot.gen - 54 visits
Gaobot - 42 visits
Worm.Trilissa.e - 41 visits
Win32/Darby.O - 40 visits
JS.Lame - Alias: HTML.Lame - 39 visits
Random Worm Pages:
Worm.Hatred.b
Worm.Req
Worm.Goma
Che is Alive worm
Rbot.blahservice - Alias: GAOBOT.BIA, RBOT-KI, RBOT.IZ, RBOT.PZ, RBOT.UA
Virus.Lovelorn@MM - Alias: I-Worm.Lovelorn
Virus.Badtrans.B@mm - Alias: Badtrans.B@mm, I-Worm.BadtransII
Worm.Nimda - Alias: W32/Nimda
Digital Doom 1.0b Worm
Worm.Recovery.B - Alias: I-Worm.Recory.b, I-Worm.Recory.b
|
|
