W32/Rbot-GO

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if present. Please read the warning about editing the registry.

Renaming the registry editor

• Using Windows explorer, browse to the Windows folder (usually C:\Windows or C:\Winnt) right-click Regedit.exe and make a copy of it.
• Rename the copy of Regedit.exe to Regedit.com.
• At the taskbar, click Start|Run. Type 'Regedit.com' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
msn = msnmsg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
msn = msnmsg.exe

and delete them if they exist.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entries:

HKCU\[code number]\Software\Microsoft\Windows\CurrentVersion\Run\
msn = msnmsg.exe
HKCU\[code number]\Software\Microsoft\Windows\CurrentVersion\RunServices\
msn = msnmsg.exe

and delete them if they exist.

Close the registry editor.

• Download and install the Microsoft patches mentioned. On standalone computers, update with all relevant security patches from Windows update.
• Check your administrator passwords and review network security.
• To renable DCOM you can edit the registry, but it's better to use Dcomcnfg.exe. See Microsoft article 825750 for details.
• The HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1" setting does not allow enumeration of SAM accounts and names. The default is "0". It can be changed in Local Security Policy. See Microsoft article 246261 for details.

W32/Rbot-GO is a worm which attempts to spread to remote network shares.
W32/Rbot-GO also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels. W32/Rbot-GO is a worm which attempts to spread to remote network shares. It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.

W32/Rbot-GO spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers and exploiting operating system vulnerabilites (including DCOM-RPC, LSASS, WebDAV and UPNP).

W32/Rbot-GO can be controlled by a remote attacker over IRC channels.

W32/Rbot-GO moves itself to the file MSNMSG.EXE in the Windows system folder and creates entries at the following locations in the registry so as to run itself on Windows login:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
msn = msnmsg.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices\
msn = msnmsg.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
msn = msnmsg.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
msn = msnmsg.exe

W32/Rbot-GO may also set the following registry entries:

HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"

W32/Rbot-GO attempts to terminate processes relating to the following files:

regedit.exe
netstat.exe
msblast.exe
zapro.exe
navw32.exe
navapw32.exe
zonealarm.exe
taskmon_exe
wincfg32.exetaskmon.exe
PandaAVEngine.exe
sysinfo.exe
mscvb32.exe
MSBLAST.exe
teekids.exe
Penis32.exe
bbeagle.exe
SysMonXP.exe
winupd.exe
winsys.exe
ssate.exe
rate.exe
d3dupdate.exe
irun4.exe
i11r54n4.exe

Patches for the operating system vulnerabilities exploited by W32/Rbot-GO can be obtained from Microsoft at:
MS04-011
MS03-026
MS03-007
MS01-059