| Port No | 16515 |
| Service Name | KiLo |
| RFC Doc | 0 |
| Protocol | UDP |
| Description | This worm propagates via network shares. It uses NetBEUI functions to scan all available network computers, gets the IP address of a found computer, and attempts to drop a copy of itself in certain network shares. It attempts to access the said network shares by using all the combinations of usernames and passwords in a very long list of strings. This worm also has backdoor capabilities. It acts as a server program controlled by an IRC bot. It connects to the IRC server zantik.zapto.org at port 6667. It then waits for commands from the IRC bot. These commands are used to control the target system and the behavior of the bot. It is also capable of gathering CD keys, serial numbers, and even application product IDs from certain software. It runs on Windows 95, 98, ME, NT, 2000, and XP. |
| Reference Link | KiLo Trojan |
| Attack | SOLUTION : Terminating the Malware Program This procedure terminates the running malware process. 1.Open Windows Task Manager. " On Windows 95, 98, and ME, press CTRL+ALT+DELETE " On Windows NT, 2000, and XP, press CTRL+SHIFT+ESC, then click the Processes tab. 2.In the list of running programs*, locate the process: REGEDLT.EXE 3.Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system. 4.To check if the malware process has been terminated, close Task Manager, and then open it again. 5.Close Task Manager. NOTE : On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.