Main Menu
Contact Us

WootBot.svcshost Worm Information

Name: WootBot.svcshost
Category: Worm
Advice: Remove
Risk: Severe Risk Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.
Description: WootBot is a memory resident Trojan worm that propagates through network shares and provides various backdoor capabilities to the attacker.

WootBot worms are known to exploit the LSASS vulnerability present on Windows systems in order to propagate. This vulnerability is a buffer overrun vulnerability that allows remote code execution, present on Windows systems. Once this vulnerability is successfully exploited, a malicious user is able to gain full control over the target system. WootBot variants are also known to propagate via network shares by using a list of user names and passwords. Moreover, it exhibits backdoor capabilities therefore compromises affected machines security. WootBot runs on Windows 95, 98, ME, NT, 2000, and XP.

Signatures: process: svcshost.exe: MD5 Hash: 86ccf104c15bcba8d2d... process: scvvhost.exe: MD5 Hash: 10cc4b6f365fb2d2a44... process: scvvhost.exe: MD5 Hash: baf386b40c1b8fe512f..
Type: Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do).

Top Worm Visited Pages:
RDBot - Alias: Rdbot.xx variants, Spybot.xx, Sdbot.xx - 1097 visits
Rbot - Alias: Backdoor.Rbot.Gen - 585 visits
Wukill.mstray - Alias: Win32/HLLW.Wukill - 564 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 468 visits
Trojan.Downloader.winstall - 243 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 242 visits
Gaobot - 201 visits
Win32/Darby.O - 185 visits
IRC.Worm.Pron - Alias: Pron.gen - 158 visits
Worm.P2P.SpyBot.gen - 120 visits

Random Worm Pages:
Taz Worm 1.00 - Alias: I-Worm.Taz
Win32.Yaha.e@mm - Alias: W32/Yaha.e@MM
Senna Worm 1


2006-2008 - Privacy Policy