W32/Shelp Worm

 Information about the W32/Shelp Worm:

W32/Shelp is a worm. The worm will infect Windows systems. The worm spreads through network. This worm exploits LSASS vulnerability present in Windows as explained by Microsoft Security Bulletin MS04-011.

Upon execution of the worm, it downloads load.exe and svchost.exe from the following IP address 207.36.180.163.

The worm modifies the Windows registry at the following location to run itself at the each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Mshelp

Microsoft has released a patch for this MS04-011 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on 17th May, 2005.

 Other names of W32/Shelp Worm:

This Worm is also known as W32.Shelp.