Signature Detail

WORM: Deloder Worm SMB Propagation Attempt

This signature detects attempts to upload the deloder worm and if the the worm is already logged into the system; the deloder worm can upload itself to the host only after successful login as Administrator (deloder uses one of 50 default passwords to login).

Extended Description

Deloder is a worm that infects vulnerable Windows 2000 and Windows XP operating systems. It propagates over the network on TCP port 445.

References

• URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deloder.html
• URL: http://vil.mcafee.com/dispVirus.asp?virus_k=100127
• URL: http://secunia.com/virus_information/1628