W32/Rbot-BCR

Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


How it spreads	Network shares
Affected operating systems	Windows
Characteristics	Installs itself in the registry
Protection available since	20 December 2005 09:10:46 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

W32/Rbot-BCR is a worm for the Windows platform.

When first run W32/Rbot-BCR copies itself to <Windows>\msconfig32x.exe.

The following registry entries are created to run msconfig32x.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Intec Service Drivers
msconfig32x.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Intec Service Drivers
msconfig32x.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Intec Service Drivers
msconfig32x.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Intec Service Drivers
msconfig32x.exe

W32/Rbot-BCR sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Intec Service Drivers
msconfig32x.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Intec Service Drivers
msconfig32x.exe

HKCU\Software\Microsoft\OLE
Intec Service Drivers
msconfig32x.exe

HKLM\SOFTWARE\Microsoft\Ole
Intec Service Drivers
msconfig32x.exe

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Get reports about the latest virus and spyware threats delivered to your computer