Spybot worm

For the antispyware program, see Spybot Search & Destroy.

The Spybot worm is a large family of computer worms of varying characteristics. Although the actual number of versions is unknown, it is estimated to be well into the thousands. This briefly held the record for most variants, but has subsequently been surpassed by the Agobot family.

Common features

Spybot variants generally have several things in common:

Recognition

Because there is no standard of detection nor classification for the Spybot family, there is also no standard naming convention. Because of this lack of standard naming conventions and because of common features, variants of the Spybot worm can often be confused with the Agobot and IRCBot family of worms. Most antivirus programs detect variants generically (e.g. W32/Spybot.worm), and identifying what specific Spybot variant is indicated is next to impossible except with the earliest or most common versions.

As a result of having so many variants, one antivirus company is often not able to recognize and remove all versions of the worm. The same applies to most antispyware software.

Denial of service attack

Early detection of the Spybot worm usually comes from network engineers detecting the Denial of Service attack generated when the worm tried to communicate back to various IRC channels.

Underground Uses

Hackers will occasionally use the worm to make easy-access programs for FTP & IRC channels

This article is issued from Wikipedia - version of the Sunday, June 10, 2012. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.