# MA-541.122015: MyCERT Alert - Dorkbot

**Date:** 04 Dec 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-541.122015  
**Advisory ID:** MA-541.122015

---

#### **1.0 Introduction**
MyCERT has received valid information from trusted sources regarding the spread of Dorkbot, which is an Internet Relay Chat (IRC) based botnet, used by cybercriminals to conduct various malicious activities.
Dorkbot spreads through USB flash drives, instant messaging programs, social networks, spam emails and drive by downloads.
**2.0 Impact**
A system that has been infected with Dorkbot, may have the following impacts:
- May be used to send spam emails
- Participate in DDoS attacks against other systems
- Harvest users' credentials for online services, including banking services.
- Disable security protection
**3.0 Affected Products**
- Microsoft Windows
**4.0 Recommendation**
- *Use and maintain anti-virus software* - Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date.
- *Change your passwords* - Your original passwords may have been compromised during the infection, so you should change them.
- *Keep your operating system and application software up-to-date* - Install software patches so that attackers cannot take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it.
- *Use anti-malware tools* - Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool (examples below) that will help with the removal of Dorkbot from your system.
- - Windows Defender for Windows 10 (<https://www.microsoft.com/security/pc-security/windows-defender.aspx> )
- Microsoft Safety Scanner (<http://www.microsoft.com/security/scanner/en-us/default.aspx> )
- Malicious Software Removal Tool (<http://www.microsoft.com/security/pc-security/malware-removal.aspx> )
- AVG Anti-virus free edition (<http://free.avg.com/ww-en/free-antivirus-download> )
- *Disable Autorun –* Dorkbot tries to use the Windows Autorun function to propagate via removable drives (e.g., USB flash drive). You can disable Autorun to stop the threat from spreading.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#fa9983989f88c3c3c3ba9983989f88899f998f88938e83d49783) or [[email protected]](/cdn-cgi/l/email-protection#8de0f4eee8fff9cde0f4eee8fff9a3e2ffeaa3e0f4) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/alerts/TA15-337A>
- <http://blogs.technet.com/b/mmpc/archive/2015/12/03/microsoft-assists-law-enforcement-to-help-disrupt-dorkbot-botnets.aspx>
- <http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32/Dorkbot>