{{for, the antispyware program, Spybot Search & Destroy The Spybot worm is a large family of

computer worm A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It wi ...

s of varying characteristics. Although the actual number of versions is unknown, it is estimated to be well into the thousands. This briefly held the record for most variants, but has subsequently been surpassed by the Agobot family.

Common features

Spybot variants generally have several things in common: * The ability to spread via the P2P program KaZaA, often in addition to other such programs. * The ability to spread via at least vulnerability in the

Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for ...

operating system. Earlier versions mostly used the

RPC RPC may refer to: Science and technology * Rational polynomial coefficient * Reactive Plastic Curtain, a carbon-dioxide-absorbing device used in some rebreather breathing sets * Regional Playback Control, a regional lockout technology for DVDs * ...

DCOM buffer overflow, although now some use the LSASS buffer overflow. * The ability to spread via various common

backdoor A back door is a door in the rear of a building. Back door may also refer to: Arts and media * Back Door (jazz trio), a British group * Porta dos Fundos (literally “Back Door” in Portuguese) Brazilian comedy YouTube channel. * Works so titl ...

Trojan horse The Trojan Horse was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer's ''Iliad'', with the poem ending before the war is concluded, ...

s. * The ability to spread to systems with weak administrative passwords.

Recognition

Because there is no standard of detection nor classification for the Spybot family, there is also no standard naming convention. Because of this lack of standard naming conventions and because of common features, variants of the Spybot worm can often be confused with the Agobot and IRCBot family of worms. Most antivirus programs detect variants generically (e.g. W32/Spybot.worm), and identifying what specific Spybot variant is indicated is next to impossible except with the earliest or most common versions. As a result of having so many variants, one antivirus company is often not able to recognize and remove all versions of the worm. The same applies to most

antispyware Spyware (a portmanteau for spying software) is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their privac ...

software.

Denial of service attack

Early detection of the ''Spybot worm'' usually comes from

network engineer A network administrator is a person designated in an organization whose responsibility includes maintaining computer infrastructures with emphasis on local area networks (LANs) up to wide area networks (WANs). Responsibilities may vary between org ...

s detecting the

Denial of Service In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host conn ...

attack generated when the worm tried to communicate back to various

IRC Internet Relay Chat (IRC) is a text-based chat system for instant messaging. IRC is designed for Many-to-many, group communication in discussion forums, called ''#Channels, channels'', but also allows one-on-one communication via instant messa ...

channels.

Underground Uses

Hackers will occasionally use the worm to make easy-access programs for FTP & IRC channels Computer worms