avserve2.exe - Dangerous
avserve2.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service.
The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
http://www.microsoft.com/technet/securit...
When launching, the worm registers itself in the system registry autorun key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
avserve2.exe = %WINDIR%\avserve2.exe
The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011.
A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.
Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself.
The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.
To remove this worm you can download free utility from www.kaspersky.com