Home Malware Programs Worms P2P-Worm.Win32.SpyBot.pxk

P2P-Worm.Win32.SpyBot.pxk

Posted: June 3, 2011

P2P-Worm.Win32.SpyBot.pxk is one of many worm variants in the SpyBot worm family. P2P-Worm.Win32.SpyBot.pxk has been observed to send information to anonymous third parties, run automatically when Windows starts, and create fake Windows program files. P2P-Worm.Win32.SpyBot.pxk is likely to use peer to peer network-shared files and other computer networks to proliferate. To protect yourself from P2P-Worm.Win32.SpyBot.pxk, avoid downloading suspicious files and monitor any files stored on networks or storage devices like USB drives.

Keeping P2P-Worm.Win32.SpyBot.pxk from Slithering Its Way onto Your PC

P2P-Worm.Win32.SpyBot.pxk spreads primarily with the help of network-shared files. Files that are widely distributed along file-sharing networks are extremely likely to be infected with P2P-Worm.Win32.SpyBot.pxk, which may be packed or otherwise compressed to avoid being detected.

P2P-Worm.Win32.SpyBot.pxk, like many worms, is also capable of spreading through local networks with ease. To catch P2P-Worm.Win32.SpyBot.pxk in the act, set your file-viewing preferences to show System and Hidden files; P2P-Worm.Win32.SpyBot.pxk may copy P2P-Worm.Win32.SpyBot.pxk's files, concealed with these attributes, to all removable drives and network-shared resources. Standard Autorun-based exploits let P2P-Worm.Win32.SpyBot.pxk infect a PC without being directly run; simply opening a folder that contains P2P-Worm.Win32.SpyBot.pxk can be enough to cause infection.

As if that weren't difficult enough to keep track of, P2P-Worm.Win32.SpyBot.pxk has also been observed to create fake Internet Explorer 'iexplore.exe' files to hide itself. These dummy files may use up excessive system resources or run when you don't have IE open in the first place.

Because P2P-Worm.Win32.SpyBot.pxk and other worms can duplicate themselves rapidly, you shouldn't try to delete all copies of P2P-Worm.Win32.SpyBot.pxk by yourself. Instead, use good anti-malware programs to scan your system for all possible copies of P2P-Worm.Win32.SpyBot.pxk. Provided that P2P-Worm.Win32.SpyBot.pxk isn't still running, any good anti-malware application should be able to delete P2P-Worm.Win32.SpyBot.pxk without problems.

Why You Should Keep on Your Toes for P2P-Worm.Win32.SpyBot.pxk Attacks

P2P-Worm.Win32.SpyBot.pxk has also been observed to engage in the following malicious behavior:

  • P2P-Worm.Win32.SpyBot.pxk can send information to outside parties without your permission. This is typically a function that worms like P2P-Worm.Win32.SpyBot.pxk use to gather account passwords and other private information. Along with this, P2P-Worm.Win32.SpyBot.pxk may create dangerous exceptions in your online security or even disable your security entirely.
  • P2P-Worm.Win32.SpyBot.pxk will launch itself without your consent every time Windows starts. P2P-Worm.Win32.SpyBot.pxk does this through typical Windows Registry exploits that can be prevented by using Safe Mode or booting from an external source (like a CD).

As a high-level security threat, P2P-Worm.Win32.SpyBot.pxk should be deleted as soon as possible. Different scanners may also detect P2P-Worm.Win32.SpyBot.pxk by names like Mal/VB-BU or Trojan.Win32.VB, since the naming conventions for worms in the Spybot worm family aren't rigorously established.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 IEXPLORE.EXE

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\DescriptionHKEY_LOCAL_MACHINE\SOFTWARE\Description\MicrosoftHKEY_LOCAL_MACHINE\SOFTWARE\Description\Microsoft\RpcHKEY_LOCAL_MACHINE\SOFTWARE\Description\Microsoft\Rpc\UuidTemporaryData
Loading...