W32/Imbot.AC is a worm. The worm will infect Windows systems and spreads through Instant Messaging Applications.

The worm will arrive as a dropped file from the network or downloaded from other malware.

The worm sends the following message with zipped file to all online contacts of an affected system via Instant Messaging Applications.

Hey, check out this great photo from my trip to England
Did you see this picture, it's hilarious!!!!!
Have I shown you this new picture of my cat :)

Upon execution, the worm drops a copy of itself as svchost.exe in the windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm attempts to connect to some remote websites to download malicious files and terminates Security Center, winvnc4 processes.

The worm also has backdoor capabilities using random port, allowing the remote attacker to get access to the infected computer.

This worm first appeared on January 24, 2008.

 Other names of W32/Imbot.AC Worm:

This Worm is also known as WORM_IMBOT.AC.