W32/Rbot-LB is a network worm which uses various security exploits to spread.
W32/Rbot-LB also contains IRC backdoor Trojan functionality, allowing unauthorised remote access to the infected computer.
W32/Rbot-LB is a worm which attempts to spread to remote network shares. It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Rbot-LB copies itself to the Windows system folder with a random nine character filename and creates entries at the following locations in the registry with the value Compliant so as to run itself on system startup, resetting them every minute:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
W32/Rbot-LB spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate command from a remote user, copying itself to the filename COMPLIANT.EXE.
W32/Rbot-LB sets the following registry entries every 2 minutes:
HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"
W32/Rbot-LB attempts to delete network shares on the host computer every 2 minutes.
W32/Rbot-LB attempts to terminate processes related to the following files:
regedit.exe
msconfig.exe
netstat.exe
msblast.exe
zapro.exe
navw32.exe
navapw32.exe
zonealarm.exe
wincfg32.exetaskmon.exe [sic]
PandaAVEngine.exe
sysinfo.exe
mscvb32.exe
MSBLAST.exe
teekids.exe
Penis32.exe
bbeagle.exe
SysMonXP.exe
winupd.exe
winsys.exe
ssate.exe
rate.exe
d3dupdate.exe
irun4.exe
i11r54n4.exe
W32/Rbot-LB may attempt to log keystrokes to the filename SYSTE.TXT in the Windows system folder.