|
|
Wootbot.moose Worm Information
| Name: |
Wootbot.moose |
| Category: |
Worm |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
WootBot is a memory resident Trojan worm that propagates through network shares and provides various backdoor capabilities to the attacker.
WootBot worms are known to exploit the LSASS vulnerability present on Windows systems in order to propagate. This vulnerability is a buffer overrun vulnerability that allows remote code execution, present on Windows systems. Once this vulnerability is successfully exploited, a malicious user is able to gain full control over the target system. WootBot variants are also known to propagate via network shares by using a list of user names and passwords. Moreover, it exhibits backdoor capabilities therefore compromises affected machines security. WootBot runs on Windows 95, 98, ME, NT, 2000, and XP.
|
| Signatures:
|
process: moose.exe: MD5 Hash: 03fd3af5c7c2a81c57a.. |
| Type: |
Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do). |
Top Worm Visited Pages:
Wukill.mstray - Alias: Win32/HLLW.Wukill - 294 visits
Rbot - Alias: Backdoor.Rbot.Gen - 276 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 229 visits
Trojan.Downloader.winstall - 182 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 89 visits
Worm.P2P.SpyBot.gen - 56 visits
Gaobot - 44 visits
Win32/Darby.O - 42 visits
Worm.Trilissa.e - 42 visits
JS.Lame - Alias: HTML.Lame - 40 visits
Random Worm Pages:
Worm.Hybris.c - Alias: W32/Hybris.gen@MM, W32/Hybris.worm
Virus.Yaha.p@MM - Alias: I-Worm.Lentin.m
Gaobot.ns
Win32/Darby.O
NoLove_MZ Worm
Ajpiidaj.2 Worm - Alias: I-Worm.Hybris.b, W32/Hybris.gen@MM, W32/Hybris.worm.B
Worm.Kagra
IRC.Worm.Jeremy
Worm.Happytime.a
MIRC.Worm.Gakk.b
|
|
