Rbot Worm
Rbot worm is a W32 spyware virus for the Windows platform. Rbot worm runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
Rbot worm spreads to other network computers infected with: Troj/Kuang, Troj/Sub7, Troj/NetDevil, W32 - MyDoom and Bagle , Troj/Optix and to other network computers by exploiting common buffer overflow vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (MS04-011) (CAN-2003-0719), UPNP (MS01-059), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030) and ASN.1 (MS04-007).
W32/Rbot-AQE copies itself to the Windows system folder as network.exe and creates the following registry entries in order to run automatically on computer login:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Update 32
network.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Update 32
network.exe
HKCU\Software\Microsoft\OLE
Microsoft Update 32
network.exe
The worm also sets the following registry entries:
HKLM\SOFTWARE\Microsoft\Ole\
EnableDCOM =
"N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
restrictanonymous =
1
...Where nothing can possibli go wrong!
Remember the 1973 film classic, Westworld? A story about a computer virus 20 years before anyone had heard of 'em. Please watch a little clip from the movie by clicking here.
Latest Computer Viruses
Books, Software