W32/Rbot-NJ

Please follow the instructions for removing worms.

W32/Rbot-NJ is a network worm which contains IRC backdoor Trojan functionality, allowing unauthorised remote access to the infected computer. W32/Rbot-NJ is a worm which attempts to spread to remote network shares. It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.

W32/Rbot-NJ spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate command from a remote user.

W32/Rbot-NJ copies itself to the Windows system folder as LOGON.EXE and creates entries at the following locations in the registry with the value "update run msword" so as to run itself on system startup, resetting them every minute:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

W32/Rbot-NJ sets the following registry entries every 2 minutes:

HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM = "N"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous = "1"

W32/Rbot-NJ attempts to delete network shares on the host computer every 2 minutes.

W32/Rbot-NJ may attempt to log keystrokes to the file REGSNS.TXT in the Windows system folder.

W32/Rbot-NJ attempts to terminate processes related to the following files:

regedit.exe
msconfig.exe
netstat.exe
msblast.exe
zapro.exe
navw32.exe
navapw32.exe
zonealarm.exe
wincfg32.exetaskmon.exe [sic]
PandaAVEngine.exe
sysinfo.exe
mscvb32.exe
MSBLAST.exe
teekids.exe
Penis32.exe
bbeagle.exe
SysMonXP.exe
winupd.exe
winsys.exe
ssate.exe
rate.exe
d3dupdate.exe
irun4.exe
i11r54n4.exe