ViroDoc
Guest
Posts: 59716
Offline
|
Posted:
Sat Jul 10, 2004 4:26 pm Post subject:
Worm Kibuv or Worm Kibuv A post removal process please |
|
|
Worm/Kibuv
This worm spreads by internet exploiting MS Windows LSASS service vulnerability described in MS Security Bulletin MS04-011 and DCOM RPC vulnerability described in MS Security Bulletin MS03-026.
Worm/Kibuv.A
Installation:
Worm spreads as KillBush.exe and when is launched it registers itself as Vote for Kerry in Run and RunServices keys in Windows Registry.
Spreading: internet
Worm searches IP addresses and when it finds a vulnerable computer it uses the exploit for downloading a copy of itself and its launching.
Worm/Kibuv.C
Installation:
Worm spreads as KillBush.exe and when is launched it registers itself as MS Autoupdate in Run and RunServices keys in Windows Registry.
Spreading: internet
Worm searches IP addresses and when it finds a vulnerable computer it uses the exploit for downloading a copy of itself and its launching. |
|