Main Menu
Contact Us

WootBot.svcshost Worm Information

Name: WootBot.svcshost
Category: Worm
Advice: Remove
Risk: Severe Risk Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.
Description: WootBot is a memory resident Trojan worm that propagates through network shares and provides various backdoor capabilities to the attacker.

WootBot worms are known to exploit the LSASS vulnerability present on Windows systems in order to propagate. This vulnerability is a buffer overrun vulnerability that allows remote code execution, present on Windows systems. Once this vulnerability is successfully exploited, a malicious user is able to gain full control over the target system. WootBot variants are also known to propagate via network shares by using a list of user names and passwords. Moreover, it exhibits backdoor capabilities therefore compromises affected machines security. WootBot runs on Windows 95, 98, ME, NT, 2000, and XP.

Signatures: process: svcshost.exe: MD5 Hash: 86ccf104c15bcba8d2d... process: scvvhost.exe: MD5 Hash: 10cc4b6f365fb2d2a44... process: scvvhost.exe: MD5 Hash: baf386b40c1b8fe512f..
Type: Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do).

Top Worm Visited Pages:
RDBot - Alias: Rdbot.xx variants, Spybot.xx, Sdbot.xx - 1137 visits
Rbot - Alias: Backdoor.Rbot.Gen - 593 visits
Wukill.mstray - Alias: Win32/HLLW.Wukill - 572 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 476 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 248 visits
Trojan.Downloader.winstall - 245 visits
Gaobot - 207 visits
Win32/Darby.O - 191 visits
IRC.Worm.Pron - Alias: Pron.gen - 164 visits
Worm.P2P.SpyBot.gen - 122 visits

Random Worm Pages:
Worm.Sonic.b - Alias: W32/Sonic@MM
Virus.Deborm - Alias: W32/Deborm.R, W32/Deborm.worm
Virus.Sobig.B@mm - Alias: I-Worm.Sobig.b
Happy New Year Worm


2006-2008 - Privacy Policy