W32/Tilebot-H

Please follow the instructions for removing worms.

W32/Tilebot-H is a worm and IRC backdoor Trojan for the Windows platform.

W32/Tilebot-H spreads to other network computers by exploiting common buffer overflow vulnerabilites, including: LSASS (MS04-011) and MSSQL (MS02-039) (CAN-2002-0649).

W32/Tilebot-H runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Tilebot-H includes functionality to:

- carry out DDoS flooder attacks
- silently download, install and run new software
- access the internet and communicate with a remote server via HTTP

When first run W32/Tilebot-H copies itself to <Windows>\msupdate24.exe and creates the file <System>\lpdriver.sys. The file <System>\lpdriver.sys can be safely deleted.

The file lpdriver.sys is registered as a new system driver service named "Lpdriver", with a display name of "Lpdriver". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Lpdriver\

The file msupdate24.exe is registered as a new system driver service named "Microsoft Update Service for 2005", with a display name of "MSUpdate" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Microsoft Update Service for 2005\

W32/Tilebot-H sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\
Microsoft\windows\CurrentVersion\Internet Settings
ProxyEnable
1

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\
Microsoft\windows\CurrentVersion\Internet Settings
ProxyEnable
1

Registry entries are created under:

HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\

The following patches for the operating system vulnerabilities exploited by W32/Tilebot-H can be obtained from the Microsoft website:

MS04-011
MS02-039