Spybot worm

From Wikipedia, the free encyclopedia

 Sections should be added to this article, to conform with Wikipedia's Manual of Style.
Please discuss this issue on the talk page.
This article has been tagged since December 2007.
This article does not cite any references or sources. (December 2007)
Please help improve this article by adding citations to reliable sources. Unverifiable material may be challenged and removed.
This article or section needs to be wikified to meet Wikipedia's quality standards.
Please help improve this article with relevant internal links. (December 2007)
For the antispyware program, see Spybot Search & Destroy.

The Spybot worm is a large family of computer worms of varying characteristics. Although the actual number of versions is unknown, it is estimated to be well into the thousands. This briefly held the record for most variants, but has subsequently been surpassed by the Agobot family. Spybot variants generally have several things in common:

  • The ability to spread via the popular P2P program KaZaA, often in addition to other such programs.
  • The ability to spread via at least vulnerability in the Microsoft Windows operating system. Earlier versions mostly used the RPC DCOM buffer overflow, although now some use the LSASS buffer overflow.
  • The ability to spread via various common backdoor Trojan horses.
  • The ability to spread to systems with weak administrative passwords.

Because there is no standard of detection nor classification for the Spybot family, there is also no standard naming convention. Most antivirus programs detect variants generically (e.g. W32/Spybot.worm), and identifying what specific Spybot variant is indicated is next to impossible except with the earliest or most common versions.

As a result of having so many variants, one anti-virus company is often not able to recognise and remove all versions of the worm. The same applies to most anti-spyware software.

Early detection of the Spybot worm usually comes from network engineers detecting the Denial of Service attack generated when the worm tried to communicate back to various IRC channels.