W32/Rbot-OV is a network worm with IRC backdoor functionality.
W32/Rbot-OV is a network worm with IRC backdoor functionality.
In order to run automatically when Windows starts up the worm copies itself to the file wint.exe in the Windows system folder.
Once installed, W32/Rbot-OV connects to a preconfigured IRC server, joins a channel and awaits further instructions. These instructions can cause the bot to perform any of the following actions:
flood a specified host with UDP, TCP, SYN, ICMP or ping packets
start a webserver offering the contents of the local drive
start a socks4 proxy server
redirect TCP connections
start a TFTP, FTP, rlogind or command shell server
transfer files via DCC
send emails
search for product keys
download and install an updated version of itself
show statistics about the infected system
show/flush the DNS cache
list/terminate running processes
list/create/destroy network shares/services
scan randomly- or sequentially-chosen IPs for infectable machines
start a keylogger
search for passwords in files, running processes and network traffic
read the contents of the clipboard
capture images from the screen or any attacked webcam
close down vulnerable services in order to secure the machine
The worm spreads to machines affected by the RPC DCOM (MS03-026, MS04-012) or LSASS (MS04-011) vulnerabilities and to computers running a MS SQL server protected by weak passwords.
W32/Rbot-OV creates or modifies the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Sygate Personal Firewall Startup = "wint.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Sygate Personal Firewall Startup = "wint.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Sygate Personal Firewall Startup = "wint.exe"
HKCU\Software\Microsoft\Ole\
Sygate Personal Firewall Startup = "wint.exe"
HKLM\Software\Microsoft\Ole\
EnableDCOM = "N"
HKLM\System\CurrentControlSet\Control\Lsa\
restrictanonymous = dword:00000001
W32/Rbot-OV may attempt to terminate or disable the following processes:
bbeagle.exe
d3dupdate.exe
i11r54n4.exe
irun4.exe
msblast.exe
MSBLAST.exe
msconfig.exe
mscvb32.exe
navapw32.exe
navw32.exe
netstat.exe
PandaAVEngine.exe
Penis32.exe
rate.exe
regedit.exe
ssate.exe
sysinfo.exe
SysMonXP.exe
teekids.exe
wincfg32.exetaskmon.exe
winsys.exe
winupd.exe
zapro.exe
zonealarm.exe