high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | December 2004 (3.88) |
| Protection available since | 22 October 2004 07:52:32 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Rbot-NI is a worm which attempts to spread to remote network shares. It also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Rbot-NI spreads through network shares with weak passwords, MSSQL servers
and through backdoors left open by other Trojans.
W32/Rbot-NI copies itself to the Windows system folder as bling.exe and may create entries in the registry at the following locations to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
The backdoor component of W32/Rbot-NI can be instructed by a remote user to perform the following functions:
start a proxy server (SOCKS4)
start a file server (FTP,HTTP)
take part in DDoS (Distributed Denial of Service) attacks
steal product registration keys from the registry
log keypresses
|
