P2P-Worm.SpyBot Description

P2P-Worm.SpyBot is a worm that spreads through a peer-peer sharing network with weak passwords, flaws in various browsers and backdoor Trojans. Once the P2P-Worm.SpyBot worm is activated it will clandestinely conceal itself from the user and add two registry keys so that it may activate itself on each Windows startup. The P2P-Worm.SpyBot worm is a serious threat to the user’s security as it will open a backdoor which gives an attacker access to gain full remote control over the users PC; thus leaving the user vulnerable to identity theft and financial losses.

Type: Worms

Automatic Detection of P2P-Worm.SpyBot

P2P-Worm.SpyBot Technical Report

As new P2P-Worm.SpyBot details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following P2P-Worm.SpyBot files with its MD5s were created in the system:

P2P-Worm.SpyBot has typically the following processes in memory:

• svshost.exe
• wuaumqr1.exe

P2P-Worm.SpyBot creates the following registry entries:

• Software\Microsoft\Windows\CurrentVersion\RunOnce\Winsock2 wqr1s

Important Article Disclaimer