W32/Rbot-ACH

Please follow the instructions for removing worms.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Close the registry editor.

W32/Rbot-ACH is a Windows network worm which attempts to spread via network shares. The worm contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels while running in the background.

The worm spreads to network shares with weak passwords and also by using the following operating system vulnerabilities:

LSASS (MS04-011)
RPC-DCOM (MS04-012)
WebDav (MS03-007)
IIS5SSL (MS04-011) (CAN-2003-0719)
MSSQL (MS02-039) (CAN-2002-0649)
UPNP (MS01-059)
Dameware (CAN-2003-1030)

The worm may also spread via backdoors left open by other Trojans and worms.

The following patches for the operating system vulnerabilities exploited by W32/Rbot-ACH can be obtained from the Microsoft website:

MS04-011
MS04-012
MS03-007
MS02-039
MS01-059 W32/Rbot-ACH is a Windows network worm which attempts to spread via network shares. The worm contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels while running in the background.

The worm spreads to network shares with weak passwords and also by using the following operating system vulnerabilities:

LSASS (MS04-011)
RPC-DCOM (MS04-012)
WebDav (MS03-007)
IIS5SSL (MS04-011) (CAN-2003-0719)
MSSQL (MS02-039) (CAN-2002-0649)
UPNP (MS01-059)
Dameware (CAN-2003-1030)

The worm may also spread via backdoors left open by other Trojans and worms.

When run W32/Rbot-ACH copies itself to the Windows System folder as a randomly named file and creates the following registry entries to run itself on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Window service
<random filename>

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Window service
<random filename>

Once installed, W32/Rbot-ACH will attempt to perform the following actions when instructed to do so by a remote attacker:

setup a FTP server
create a SOCKS4 server
terminate threads and processes
perform port scanning on IP addresses
steal computer system hardware information
capture keystrokes
copy itself to IPC$ network shared folders
login to MS SQL servers and send EXEC commands to open a command shell
download files from the internet and run them
participate in denial of service (DoS) attacks

The following patches for the operating system vulnerabilities exploited by W32/Rbot-ACH can be obtained from the Microsoft website:

MS04-011
MS04-012
MS03-007
MS02-039
MS01-059