W32/Rbot-APO

Please follow the instructions for removing worms.

W32/Rbot-APO is a worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-APO spreads to other network computers by exploiting common buffer
overflow vulnerabilities, including: LSASS (MS04-011) and PNP (MS05-039).

W32/Rbot-APO runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.

W32/Rbot-APO includes functionality to:

- perform port scanning
- carry out DDoS flooder attacks
- silently download, install and run new software
- steal information

When first run W32/Rbot-APO copies itself to \mame.exe.

The following registry entries are created to run mame.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Host Process
mame.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Host Process
mame.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Host Process
mame.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Host Process
mame.exe

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Host Process
mame.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Host Process
mame.exe

HKCU\Software\Microsoft\OLE
Host Process
mame.exe

HKLM\SOFTWARE\Microsoft\Ole
Host Process
mame.exe

The following patches for the operating system vulnerabilities exploited by
W32/Rbot-APO can be obtained from the Microsoft website:

MS04-011
MS05-039