Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

W32/Imbiat.worm

Feb 9, 2004 12:11AM PST

Date Discovered: 1/3/2004
Date Added: 2/9/2004
Origin: Unknown
Length: Approx. 21Kb
Type: Virus
SubType: Worm

This worm tries to copy itself over the network using a combination of weak username/passwords and has Backdoor capablities.

When being run, on a Win2000 system, it copies itself into c:\winnt\system32 as *****.exe

The following registry key is modified so that it starts up automatically after a restart.

HKEY_LOCAL_MACHINE\Sofware\Microsoft\Windows NT\CurrentVersion\winlogon "Shell" = Explorer.exe *****.exe
When run on a Win98/Me system the worm copies itself to the C:\Windows\System folder as *****.exe.

The System.ini file is modified so that it runs after every reboot.

More: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101001

Discussion is locked