Home Malware Programs Worms W32.Kwbot.P.Worm

W32.Kwbot.P.Worm

Posted: March 28, 2006

W32.Kwbot.P.Worm is a worm that attempts to spread through file-sharing networks, such as KaZaA, iMesh, LimeWire, eDonkey2000, and Morpheus. It has Backdoor capabilities that allow a hacker to control a PC by using Internet Relay Chat . The indication of a possible infection is existence of the file mscommand.exe.

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}Browsetothekey:DeletethevalueSystemEfficiencyMonitor=mscommand.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
Loading...