W32/Rbot-VY

Please follow the instructions for removing worms.

W32/Rbot-VY is a network worm with backdoor functionality for the Windows platform.

W32/Rbot-VY spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS) and using backdoors opened by other worms or Trojans.

W32/Rbot-VY copies itself to the Windows system folder as TASKMNSGR.EXE and creates entries at the following locations in the registry so as to run itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
VITAL BOOT PROCESS
taskmnsgr.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
VITAL BOOT PROCESS
taskmnsgr.exe

W32/Rbot-VY may set the following registry entries:

HKLM\SOFTWARE\Microsoft\Ole\
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
restrictanonymous
1

W32/Rbot-VY may try to delete the C$, D$, E$, IPC$ and ADMIN$ network shares on
the host computer.

W32/Rbot-VY may also try to log keystrokes and window text to a file called KEYS.TXT in the Windows system folder.

Patches for the operating system vulnerabilities exploited by W32/Rbot-VY can be obtained from Microsoft at:

http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx

Sophos's anti-virus products include proactive protection technology, which can defend against new threats without requiring an update. Sophos customers have been protected against W32/Rbot-VY (detected as W32/Rbot-Fam) since version 3.89.