W32/Antixbot.A Worm

 Information about the W32/Antixbot.A Worm:

W32/Antixbot.A is a worm. The worm will infect Windows systems and spreads through Windows Live Messenger.

Upon execution, the worm displays the following error message:
Title: Error
Body: Profile doesnt exist!

It copies itself as svchost.exe in Windows System\(Random Name) folder.

It modifies the registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The worm creates the following shortcut link in an attempt to persuade a user to launch the application:

%UserProfile%\start Menu\Programs\svchost.lnk

The worm changes the default home page for Internet Explorer and Mozilla Firefox.

It may also attempt to disable the Microsoft Internet Explorer antiphishing filter by modifying the registry.

The worm may also modify the hosts file.

The worm opens a back door on the infected computer by connecting to any of the following IRC servers:

rad.clip-engine.com on TCP port 1598
lol.wewillbebackshortlystaystuned.org on TCP port 6667
encrraadd.com on TCP port 6667

The worm listens for commands from the remote attacker and then performs the following actions:

Gather confidential system information
Download updates to itself
Download and execute files
Start a UDP, syn or ping flood
Spread through Windows Live Messenger
Uninstall itself

This worm first appeared on June 14, 2007.

 Other names of W32/Antixbot.A Worm:

This Worm is also known as W32.Antixbot.A, W32/Chode-AC .