Woredbot is a dangerous worm that spreads to network computers by exploiting known vulnerabilities of the Microsoft Windows operating system. It also propagates through instant messages using popular clients such as ICQ, AIM, MSN Messenger and Yahoo! Messenger. Once installed, the parasite runs a payload. It disables essential system components and attempts to terminate running firewalls, antiviruses, anti-spyware and anti-malware software. Woredbot also opens a back door providing the attacker with unauthorized remote access to the compromised computer. The intruder can download and run arbitrary files, execute any system commands, record user keystrokes, launch Denial of Service (DoS) attacks and search for vulnerable hosts. Furthermore, Woredbot can be used to run a hidden proxy service. The parasite is able to steal confidential information the user enters on e-gold online money service web sites. It runs on every Windows startup.