| Port No | 31338 |
| Service Name | Deep BO |
| RFC Doc | 0 |
| Protocol | UDP |
| Description | This worm spreads via network shares, and takes advantage of the following Windows vulnerability to propagate across networks: Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability .This worm attempts to log on to systems using a list of user names and passwords hardcoded in its body. It then drops a copy of itself in the accessed machines. This worm also steals the CD keys of certain game applications. It also has backdoor capabilities and may execute commands issued by a remote user.This worm runs on Windows NT, 2000 and XP. |
| Reference Link | Deep BO Trojan |
| Attack | SOLUTION : Identifying the Malware Program To remove this malware, first identify the malware program. 1.Scan your system with your Trend Micro antivirus product. 2.NOTE all files detected as WORM_RBOT.BO. Trend Micro customers need to download the latest pattern file before scanning their system. Other users can use Housecall, Trend Micro’s free online virus scanner. Terminating the Malware Program This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier. 1.Open Windows Task Manager. Press CTRL+SHIFT+ESC, then click the Processes tab. 2.In the list of running programs, locate the malware file(s) detected earlier. 3.Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system. 4.Do the same for all detected malware files in the list of running processes. 5.To check if the malware process has been terminated, close Task Manager, and then open it again. 6.Close Task Manager. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.