high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 14 September 2004 10:58:22 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Rbot-JI is a worm and backdoor for the Windows platform.
W32/Rbot-JI spreads to network shares and Microsoft SQL servers with weak passwords as well as by exploiting operating system vulnerabilities and backdoors opened by other worms. The operating system vulnerabilities exploited by this worm are addresses by Microsoft Security Bulletins MS04-012, MS04-011, MS03-007 and MS01-059.
W32/Rbot-JI creates a copy of itself in the Windows system folder as wuamgrdn.exe and adds the following registry entries to ensure that the copy is run each time Windows is started:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Security Patches = "wuamgrdn.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Security Patches = "wuamgrdn.exe"
HKCU\Software\Microsoft\OLE
Security Patches = "wuamgrdn.exe"
The backdoor component of W32/Rbot-JI contacts an IRC server and waits for commands from a remote attacker.
The functions available through the backdoor include:
Distributed denial of service attack
Proxy servers
Packet sniffing
Keystroke logging
Remote shell
Video capture
File upload and download
|
