New worm drops Trojan army

By Matt Whipp

Posted on 17 Mar 2003 at 10:46

Sophos has highlighted reports of a new worm - W32/Deborm-R - that installs three Trojan components onto infected systems.

W32/Deborm-R is a network worm that will attempt to spread itself across the local network - specifically, across shared systems named C or C$ that reside on the local IP subnet and that have no password.

The worm then attempts to copy itself to the start up folder on vulnerable systems and will install three Trojan components: Litmus-203, Sdbot-Fam and KillAV-Q.

The worm is already out in the wild - ie in the public domain - although it has infected few systems at the time of writing. It also uses MultiDropper-FL and Worm.Win32.Deborm.r aliases.

For more information, see the Sophos Web site.