W32/Rbot-MM

Please follow the instructions for removing worms.

W32/Rbot-MM is a worm which attempts to spread to remote network shares. It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.

W32/Rbot-MM copies itself to the Windows system folder with a random 10-character filename and creates entries at the following locations in the registry with the value WindowsRegKey update so as to run itself on system startup, resetting them every minute:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Rbot-MM spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate command from a remote user, copying itself to the filename WINUPDATES.EXE.

W32/Rbot-MM sets the following registry entries every 2 minutes:

HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"

W32/Rbot-MM attempts to delete network shares on the host computer every 2 minutes.

W32/Rbot-MM may attempt to log keystrokes to the file SYSTEMLOG.TXT in the Windows system folder.

W32/Rbot-MM attempts to terminate processes related to the following files:

regedit.exe
msconfig.exe
netstat.exe
msblast.exe
zapro.exe
navw32.exe
navapw32.exe
zonealarm.exe
wincfg32.exetaskmon.exe [sic]
PandaAVEngine.exe
sysinfo.exe
mscvb32.exe
MSBLAST.exe
teekids.exe
Penis32.exe
bbeagle.exe
SysMonXP.exe
winupd.exe
winsys.exe
ssate.exe
rate.exe
d3dupdate.exe
irun4.exe
i11r54n4.exe