W32/Rbot-ACS

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Close the registry editor.

Check the following items

• To renable DCOM you can edit the registry, but it's better to use Dcomcnfg.exe. See Microsoft article 825750 for details.
• The HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1" setting does not allow enumeration of SAM accounts and names. The default is "0". It can be changed in Local Security Policy. See Microsoft article 246261 for details.
• Check your administrator passwords and review network security.

W32/Rbot-ACS is a Windows network worm which attempts to spread via network shares. The worm contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels while running in the background.

The worm spreads to network shares with weak passwords and also by using the following security exploits:

LSASS (MS04-011)
RPC-DCOM (MS03-039)
WKS (MS03-049) (CAN-2003-0812)
MSSQL (MS02-039) (CAN-2002-0649)

When run W32/Rbot-ACS moves itself to the Windows System folder as a hidden, read-only, system file named look.exe and creates the following registry entries to run itself on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Outlook Express Protocol
look.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Outlook Express Protocol
look.exe

W32/Rbot-ACS also changes the following registry entries from the default Windows values:

from:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
Y

to:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

from:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
dword:00000000

to:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
dword:00000001

The worm also creates the following registry entry:

HKCU\Software\Microsoft\Ole
Outlook Express Protocol
look.exe

Once installed, W32/Rbot-ACS will attempt to perform the following actions when instructed to do so by a remote attacker:

terminate anti-virus and system related threads and processes
perform port scanning on IP addresses
steal computer system hardware information
copy itself to network shared folders
download files from the Internet and run them
participate in denial of service (DoS) attacks

The following patches for the operating system vulnerabilities exploited by W32/Rbot-ACS can be obtained from the Microsoft website:

LSASS (MS04-011) security vulnerability

RPC-DCOM (MS03-039) security vulnerability

WKS (MS03-049) (CAN-2003-0812) security vulnerability

MSSQL (MS02-039) (CAN-2002-0649) security vulnerability