W32/Rbot-CMS

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entries:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\RunServices\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Rbot-CMS is a worm for the Windows platform.

The worm contains backdoor functions that allows unauthorized remote access to the infected computer via IRC channels while running in the background.

W32/Rbot-CMS spreads
- to computers vulnerable to common exploits, including: LSASS (MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049), PNP (MS05-039) and ASN.1 (MS04-007)
- to MSSQL servers protected by weak passwords
- to network shares

The following patches for the operating system vulnerabilities exploited by the worm can be obtained from the Microsoft website:

MS04-011

MS04-012

MS03-049

MS05-039

MS04-007

When first run W32/Rbot-CMS copies itself to <System>\omns.exe.

The following registry entries are created to run omns.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Omni
omns.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Omni
omns.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Omni
omns.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Omni
omns.exe

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Omni
omns.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Omni
omns.exe

HKCU\Software\Microsoft\OLE
Omni
omns.exe

HKLM\SOFTWARE\Microsoft\Ole
Omni
omns.exe