W32/Rbot-ABP is a Windows network worm which attempts to spread via network shares. The worm contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels while running in the background.
The worm spreads to network shares with weak passwords and also by using the LSASS security exploit (MS04-011) and the RPC-DCOM security exploit (MS03-039).
When run W32/Rbot-ABP copies itself to the Windows System folder as a hidden, read-only, system file named MSFIREWALI.EXE and creates the following registry entries to run itself on user logon:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
USBDrives
msfirewalI.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
USBDrives
msfirewalI.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
USBDrives
msfirewalI.exe
W32/Rbot-ABP also changes the following registry entries from the default Windows values:
from:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
Y
to:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
from:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
dword:00000000
to:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
dword:00000001
Once installed, W32/Rbot-ABP will attempt to perform the following actions when instructed to do so by a remote attacker:
steal CD game keys
setup a FTP server
create a SOCKS4 server
terminate threads and processes
perform port scanning on IP addresses
steal computer system hardware information
capture keystrokes
copy itself to IPC$ network shared folders
download files from the internet and run them
participate in denial of service (DoS) attacks
The following patches for the operating system vulnerabilities exploited by W32/Rbot-ABP can be obtained from the Microsoft website:
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx"
target="_blank">MS04-011</a>
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx"
target="_blank">MS03-039</a>