W32/Rbot-LP

Please follow the instructions for removing worms.

W32/Rbot-LP is a network worm with IRC backdoor functionality.

In order to run automatically when Windows starts up the worm copies itself to the file winhelpsv.exe in the Windows system folder.

Once installed, W32/Rbot-LP connects to a preconfigured IRC server, joins a channel and awaits further instructions. These instructions can cause the bot to perform any of the following actions:

flood a specified host with UDP, TCP, SYN, ICMP or ping packets
start a webserver offering the contents of the local drive
start a socks4 proxy server
redirect TCP connections
start a TFTP, FTP, rlogind or command shell server
transfer files via DCC
send emails
search for product keys
download and install an updated version of itself
show statistics about the infected system
show/flush the DNS cache
list/terminate running processes
list/create/destroy network shares/services
scan randomly- or sequentially-chosen IPs for infectable machines
start a keylogger
search for passwords in files, running processes and network traffic
read the contents of the clipboard
capture images from the screen or any attacked webcam
close down vulnerable services in order to secure the machine

The worm spreads to machines affected by the RPC DCOM (MS03-026, MS04-012) or LSASS (MS04-011) vulnerabilities or running a MS SQL server protected by a weak password.

W32/Rbot-LP creates or modifies the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Help Service = "winhelpsv.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Windows Help Service = "winhelpsv.exe"

HKCU\Software\Microsoft\OLE
Windows Help Service = "winhelpsv.exe"