Home Malware Programs Worms Esbot

Esbot

Posted: March 28, 2006

Esbot is a dangerous and rapidly spreading Internet worm that infects PCs running Windows operating computer with unfixed security vulnerabilities. Esbot is designed to give the remote attacker full unauthorized access to a compromised computer. It attempts to infect vulnerable remote PCs with random addresses, disables essential Windows components and restricts access to shared disk drives. Esbot runs on every OS startup and secretly works in background.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 mousebm.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINESOFTWAREMicrosoftOLEEnableDCOM=NHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsaestrictanonymous=1

Related Posts

Loading...