W32/Rbot-GSQ is a worm for the Windows platform.
W32/Rbot-GSQ spreads via network shares and the following vulnerabilities:
- LSASS (MS04-011)
- SRVSVC (MS06-040)
- RPC-DCOM (MS04-012)
- PNP (MS05-039)
- ASN.1 (MS04-007)
- RealVNC (CVE-2006-2369)
- Symantec (SYM06-010)
- Weak network and MSSQL server passwords
W32/Rbot-GSQ is a worm for the Windows platform.
W32/Rbot-GSQ spreads via network shares and the following vulnerabilities:
- LSASS (MS04-011)
- SRVSVC (MS06-040)
- RPC-DCOM (MS04-012)
- PNP (MS05-039)
- ASN.1 (MS04-007)
- RealVNC (CVE-2006-2369)
- Symantec (SYM06-010)
- Weak network and MSSQL server passwords
When first run W32/Rbot-GSQ copies itself to:
<System>\winsys32.exe.
The following registry entries are created to run winsys32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft
winsys32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft
winsys32.exe
The following registry entry is set:
HKCU\Software\Microsoft\OLE
Microsoft
winsys32.exe