W32/Rbot-ZP is an IRC backdoor Trojan and network worm.
W32/Rbot-ZP may spread to remote network shares protected by weak passwords and computers vulnerable to common exploits. The worm also opens up a backdoor, allowing unauthorised remote access to infected computers via the IRC network, while running in the background as a service process.
W32/Rbot-ZP is an IRC backdoor Trojan and network worm.
W32/Rbot-ZP may spread to remote network shares protected by weak passwords and computers vulnerable to common exploits. The worm also opens up a backdoor, allowing unauthorised remote access to infected computers via the IRC network, while running in the background as a service process.
The worm exploits the following vulnerabilities: RPC-DCOM (MS04-12) and LSASS (MS04-11). For patches for these vulnerabilities, see:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
W32/Rbot-ZP can receive commands from a remote intruder such as, delete network shares,log keypresses, participate in DDoS attacks, scan other computers for vulnerabilities and create administrator accounts.
W32/Rbot-ZP copies itself to the Windows system folder as MSMSN32.EXE and creates the following registry entries in order to run automatically on computer login:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Messenger XP
MSMSN32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Messenger XP
MSMSN32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Messenger XP
MSMSN32.exe