W32.Tkbot.Worm

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy

Risk Level 1: Very Low

Printer Friendly Page|Rate this page

Discovered:: February 7, 2003
Updated:: February 13, 2007 11:42:49 AM
Type:: Worm
Systems Affected:: Microsoft IIS, Windows 2000, Windows NT
CVE References:: CVE-2000-0884

W32.Tkbot.Worm is a worm that installs a backdoor on compromised systems and allows a hacker to gain access to your computer without your knowledge, controlling it via IRC. W32.Tkbot.Worm consists of several parts, including an FTP server and an IRC client.

The worm permits a hacker to:

Gather user and system information
Upload files to your computer
Download files from your computer
Execute programs
Attempt to gain root access to another remote computer
Use your computer as a drone in a Distributed Denial of Service (DDoS) attack against a remote system
Scan for other vulnerable systems to be compromised
Execute port scans on the systems to be compromised to determine the running services

NOTE: Virus definitions dated prior to February 12, 2003 may detect this threat as either IRC Trojan or Backdoor.Tkbot.