W32/Rbot-HJ

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ccApp.exe = ccApp.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
ccApp.exe = ccApp.exe

and delete them if they exist.

Close the registry editor.

Check your administrator passwords and review network security.

W32/Rbot-HJ is an IRC backdoor worm.

When run, the worm copies itself as ccApp.exe into the Windows system folder. In order to be run on startup, the worm creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ccApp.exe = ccApp.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
ccApp.exe = ccApp.exe

The worm then connects to an IRC channel and listens for commands, allowing a remote user to control the machine.

W32/Rbot-HJ may spread to remote network shares with weak passwords, copying itself into the Windows system directory on the destination machine. The worm may also spread by email, IRC or FTP.

W32/Rbot-HJ may also steal keys for certain software, launch denial of service attacks, capture webcam images, or delete network shares.