high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 1 August 2007 00:37:10 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Rbot-GSN is a worm with IRC backdoor functionality for the Windows platform.
W32/Rbot-GSN spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: SRVSVC (MS06-040), RPC-DCOM (MS04-012) Symantec (SYM06-010) and ASN.1 (MS04-007). The worm may also spreads via network shares and removable storage devices.
W32/Rbot-GSN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Rbot-GSN includes functionality to download, install and run new software.
W32/Rbot-GSN spreads to other network computers by exploiting common buffer overflow vulnerabilities, including: SRVSVC (MS06-040), RPC-DCOM (MS04-012) Symantec (SYM06-010) and ASN.1 (MS04-007). The worm may also spreads via network shares and removable storage devices.
W32/Rbot-GSN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Rbot-GSN includes functionality to download, install and run new software.
When first run W32/Rbot-GSN copies itself to:
<System>\<random>.exe
<Root>\<random>.exe
and creates the file <Root>\autorun.inf.
W32/Rbot-GSN may also copy itself to existing zip files.
The following registry entry is created to run rwomlysrm.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon32
<System>\<random>.exe
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
<System>\<random>.exe
<System>\<random>.exe:*:Enabled:ctfmon32
|
