Virus Database

Worm.Win32.Slackor

Description Worm.Win32.Slackor

This is a multi-component network worm. The worm spreads over shared network resources. The worm has bugs and has a little chance to spread over networks.
The worm's components are:
cnn3.exe - the main component (Win32 EXE file about 350K of size)
abc.bat - BAT file (about 1344 bytes)
main.exe - trojan component (Win32 EXE file, 53280 bytes)
psexec.exe - remote execution utility (not a virus/trojan, Win32 EXE file, 122880 bytes)
slacke-worm.exe - searches for network addresses (Win32 EXE files, 25K/28K depending on worm version)

The main worm component is "trojan dropping" utility and is detected as "TrojanDropper.Win32.Yabinder".
On run it creates the "C:sp" subdirectory, drops and executes following files in there:
C:spabc.bat
C:spmain.exe
C:sppsexec.exe
C:spslacke-worm.exe

The "main.exe" component is the backdoor trojan, and it is detected as "Backdoor.SdBot".
The "slacke-worm.exe" component looks for network resources and tries to copy and activate worm copy in there with a help of two other components:
abc.bat - tries to connect to a remote resource by trying a set of logins and passwords
psexec.exe - is used to run remote worm copy on remote computer.

Check other viruses! Be aware! Use Antiviral Software

Kit.2384

Description Kit.2384

This is not a dangerous memory resident parasitic virus. It hooks INT 1Ch, 21h and writes itself to the beginning of the COM files and to the end of EXE files that are executed. It sometimes changes the keyboard flags (Ctrl, Alt, Shift flags), contains the text:
Copyright 1991-1999. KIT VIRUS (version 2.0).

Kitiara.288

Description Kitiara.288

It is a very dangerous memory resident overwriting virus. It hooks INT 21h and overwrites each file that is executed. Before returning control to DOS the virus displays:
Bad command or filename

On September 1st it overwrites all files in the current directory with the text:
Kitiara 1.0
Coder: The Exectioner

Home