imported>JoeNMLC: /* top */ ce, rm unref. tag

2024-01-22T22:22:01Z

top: ce, rm unref. tag

New page

{{Short description|Large computer worm family}}
{{for|the antispyware program|Spybot Search & Destroy}}

The '''Spybot worm''' is a large family of [[computer worm]]s of varying characteristics. Although the actual number of versions is unknown, it is estimated to be well into the thousands. This briefly held the record for most variants, but has subsequently been surpassed by the [[Agobot]] family.<ref>Infosecurity 2008 Threat Analysis, page 16, {{ISBN|1-59749-224-8}} {{ISBN|978-1-59749-224-9}}</ref><ref>https://www.wsj.com/public/article_print/SB116900488955878543-yrMHYlacFyxijV14BxFZfXeU1_8_20070216.html How Legal Codes Can Hinder Hacker Cases</ref>

==Common features==
Spybot variants generally have several things in common:

* The ability to spread via the [[Peer-to-peer file sharing|P2P]] program [[KaZaA]], often in addition to other such programs.
* The ability to spread via at least vulnerability in the [[Microsoft Windows|Windows]] operating system. Earlier versions mostly used the [[Remote procedure call|RPC]] [[Distributed Component Object Model|DCOM]] buffer overflow, although now some use the [[Local Security Authority Subsystem Service|LSASS]] buffer overflow.
* The ability to spread via various common [[Backdoor (computing)|backdoor]] [[Trojan horse (computing)|Trojan horse]]s.
* The ability to spread to systems with weak administrative passwords.

==Recognition==
Because there is no standard of detection nor classification for the Spybot family, there is also no standard naming convention. Because of this lack of standard naming conventions and because of common features, variants of the Spybot worm can often be confused with the [[Agobot]] and [[Backdoor.Win32.IRCBot|IRCBot]] family of worms. Most antivirus programs detect variants generically (e.g. W32/Spybot.worm), and identifying what specific Spybot variant is indicated is next to impossible except with the earliest or most common versions.

As a result of having so many variants, one antivirus company is often not able to recognize and remove all versions of the worm. The same applies to most [[antispyware]] software.

==Denial of service attack==
Early detection of the ''Spybot worm'' usually comes from [[network engineer]]s detecting the [[Denial of Service]] attack generated when the worm tried to communicate back to various [[IRC]] channels.

==Underground Uses==
Hackers will occasionally use the worm to make easy-access programs for FTP & IRC channels

==References==
{{Reflist}}

[[Category:Computer worms]]

Spybot worm - Revision history

imported>JoeNMLC: /* top */ ce, rm unref. tag