Win32/Dorkbot [Threat Name] go to Threat

Win32/Dorkbot.B [Threat Variant Name]

Category	worm
Size	172032 B
Aliases	Worm.Win32.Ngrbot.gqj (Kaspersky)
	W32/Kolab.gen.p (McAfee)
	Worm:Win32/Dorkbot (Microsoft)

Win32/Dorkbot.B is a worm that spreads via removable media. The worm serves as a backdoor. It can be controlled remotely.

When executed, the worm copies itself into the following location:

In order to be executed on every system start, the worm sets the following Registry entry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "%variable%" = "%appdata%\%variable%.exe"

A string with variable content is used instead of %variable% .

The worm creates and runs a new thread with its own program code in all running processes except the following:

Win32/Dorkbot.B is a worm that spreads via removable media.

The worm copies itself to the following location:

A string with variable content is used instead of %variable% .

The worm creates the following file:

The file is a shortcut to a malicious file.

The worm may create the following files:

Worm is spread via links in social networking sites.

The following social networking sites are affected:

The worm collects sensitive information when the user browses certain web sites.

The worm gathers information related to the following services:

The following information is collected:

The worm attempts to send gathered information to a remote machine. The HTTP protocol is used.

The worm serves as a backdoor. It can be controlled remotely.

The worm connects to the following addresses:

The IRC protocol is used.

It can execute the following operations:

download files from a remote computer and/or the Internet
run executable files
update itself to a newer version
perform DoS/DDoS attacks
spread via removable drives
spread via MSN network
monitor network traffic
modify network traffic
redirect network traffic
block access to specific websites
post messages on social networks
insert IFRAME tag(s) into HTML pages with a specific URL pointing to malicious software
open a specific URL address
set up a proxy server
send gathered information

The worm blocks access to any domains that contain any of the following strings in their name:

The worm hooks the following Windows APIs: