| Port No | 5050 |
| Service Name | AIQ |
| RFC Doc | 0 |
| Protocol | TCP |
| Description | This worm spreads via network shares. It gathers available lists of user names and passwords. It then lists down available network shares and uses these credentials to access and drop a copy of itself in the said shares.
Aside from the gathered user names and passwords, it also uses a list of user names and passwords hardcoded in its body to access target machines. It has backdoor capabilities. It connects to a remote IRC server and joins a specific IRC channel, where it receives commands coming from a remote malicious user. The said commands are then executed locally on affected machines. It is also capable of automatically notifying the bot of systems vulnerable to the a list of Windows vulnerabilities. Furthermore, it terminates a list of antivirus-related processes to avoid detection. |
| Reference Link | AIQ |
| Attack | Solution: This procedure terminates the running malware process. Open Windows Task Manager. ・On Windows 98, and ME, press CTRL+ALT+DELETE ・On Windows NT, 2000, and XP, press CTRL+SHIFT+ESC, then click the Processes tab. In the list of running programs*, locate the process: msvload32.exe. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system. To check if the malware process has been terminated, close Task Manager, and then open it again. Close Task Manager. -------------------------------------------------------------------------------- *NOTE: On systems running Windows 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.