Alert over Spybot worm

An updated variant of a malicious bot program is spreading via a flaw in Symantec's antivirus software as well as through several holes in Microsoft code.

The program, called 'Spybot.ACYR' by Symantec and 'Sdbot.worm!811a7027' by McAfee, appears to be targeting educational institutions, according to a blog item posted by Symantec. The security company said: "We are seeing a spike in traffic on port 2967 with activity only in the dot-edu domain. The impact of the attack is minimal thus far."

Want more photos?

Click here to browse the full archive of our photo stories.

This Spybot variant attempts to break into computers through a six-month-old vulnerability in Symantec Client Security and Symantec AntiVirus. A fix has been available since 25 May. Symantec said: "Customers who have applied the patch in their environment are unaffected by the worm."

Additionally, the bot program tries to exploit five flaws in Microsoft Windows, the most recent of which was patched in August and affects Windows file and printer sharing. The oldest Windows flaw of the five dates back to 2004, according to Symantec's alert.

When installed on a PC, Spybot opens a back door in the system and connects to an internet relay chat (IRC) server to let the remote attacker control the compromised computer. Spybot first surfaced in 2003 and has spawned many offshoots.

Bot software such as Spybot is the most prevalent threat to Windows PCs, according to a recent Microsoft security report. More than 43,000 new variants of such insidious programs were found in the first half of 2006, making it the most active category of malicious software, Microsoft said.

A computer taken by such a bot is popularly referred to as a 'zombie PC'. It can be used by miscreants as part of a network of bots, or 'botnet', to relay spam and launch cyber attacks. Additionally, hackers often steal the victim's data and install spyware and adware on PCs, to earn a kickback from the spyware or adware maker.

Joris Evers writes for CNET News.com