high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | July 2006 (4.07) |
| Protection available since | 26 May 2006 21:48:12 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Rbot-DVE is a worm for the Windows platform.
W32/Rbot-DVE spreads
- to computers vulnerable to common exploits, including: LSASS (MS04-011), RPC-
DCOM (MS04-012) and WKS (MS03-049)
- to MSSQL servers protected by weak passwords
- to network shares protected by weak passwords
When first run W32/Rbot-DVE copies itself to <System>\usaplug.exe.
The following registry entries are created to run usaplug.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft USA Plug
usaplug.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft USA Plug
usaplug.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft USA Plug
usaplug.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft USA Plug
usaplug.exe
Registry entries are set as follows:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Microsoft USA Plug
usaplug.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Microsoft USA Plug
usaplug.exe
HKCU\Software\Microsoft\OLE
Microsoft USA Plug
usaplug.exe
HKLM\SOFTWARE\Microsoft\Ole
Microsoft USA Plug
usaplug.exe
W32/Rbot-DVE attempts to reset thes registry entries periodically.
W32/Rbot-DVE attempts to terminate a large number of processes related to anti-virus and security software.
W32/Rbot-DVE modifies the HOSTS file, appending the following lines to prevent access to the websites listed:
0.0.0.0 www.symantec.com
0.0.0.0 securityresponse.symantec.com
0.0.0.0 symantec.com
0.0.0.0 www.sophos.com
0.0.0.0 sophos.com
0.0.0.0 www.mcafee.com
0.0.0.0 mcafee.com
0.0.0.0 liveupdate.symantecliveupdate.com
0.0.0.0 www.viruslist.com
0.0.0.0 viruslist.com
0.0.0.0 viruslist.com
0.0.0.0 f-secure.com
0.0.0.0 www.f-secure.com
0.0.0.0 kaspersky.com
0.0.0.0 kaspersky-labs.com
0.0.0.0 www.avp.com
0.0.0.0 www.kaspersky.com
0.0.0.0 avp.com
0.0.0.0 www.networkassociates.com
0.0.0.0 networkassociates.com
0.0.0.0 www.ca.com
0.0.0.0 ca.com
0.0.0.0 mast.mcafee.com
0.0.0.0 my-etrust.com
0.0.0.0 www.my-etrust.com
0.0.0.0 download.mcafee.com
0.0.0.0 dispatch.mcafee.com
0.0.0.0 secure.nai.com
0.0.0.0 nai.com
0.0.0.0 www.nai.com
0.0.0.0 update.symantec.com
0.0.0.0 updates.symantec.com
0.0.0.0 us.mcafee.com
0.0.0.0 liveupdate.symantec.com
0.0.0.0 customer.symantec.com
0.0.0.0 rads.mcafee.com
0.0.0.0 trendmicro.com
0.0.0.0 pandasoftware.com
0.0.0.0 www.pandasoftware.com
0.0.0.0 www.trendmicro.com
0.0.0.0 www.grisoft.com
0.0.0.0 www.microsoft.com
0.0.0.0 microsoft.com
0.0.0.0 www.virustotal.com
0.0.0.0 virustotal.com
0.0.0.0 www.zango.com
0.0.0.0 zango.com
|
