Sophos

W32/Rbot-GWT

Aliases
  • W32.Spybot.Worm
  • Backdoor.Win32.Rbot.gen
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Network shares
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from June 2008 (4.30)
Protection available since 14 April 2008 21:34:34 (GMT)
Detected by All Sophos products

Action

More Information

W32/Rbot-GWT runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Rbot-GWT spreads
 - to computers vulnerable to common exploits, including: SRVSVC (MS06-040), WKS (MS03-049), MSSQL (MS02-039), PNP (MS05-039), ASN.1 (MS04-007), Realcast, RealVNC (CVE-2006-2369) and Symantec (SYM06-010)
 - to network shares protected by weak passwords

When first run W32/Rbot-GWT copies itself to <System>\msnupdate.exe.

The following registry entries are created to run msnupdate.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(default)
msnupdate.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
(default)
msnupdate.exe

W32/Rbot-GWT sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).

Registry entries are set as follows:

HKCU\Software\Microsoft\OLE
(default)
msnupdate.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MaxConnectionsPer1_0Server
50

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MaxConnectionsPerServer
50

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

Registry entries are created under:

HKLM\SOFTWARE\WinLicense


RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer