high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Included in our products from | April 2005 (3.92) |
| Protection available since | 17 February 2005 21:11:43 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Rbot-WD is a network worm with backdoor functionality for the Windows platform.
W32/Rbot-WD is capable of spreading to computers on the local network protected by weak passwords after receiving the appropriate backdoor command.
W32/Rbot-WD will attempt to spread by exploiting the following vulnerabilities:
DCOM (MS04-012)
LSASS (MS04-011)
Microsoft SQL servers with weak passwords.
When first run, W32/Rbot-WD copies itself to the Windows system folder as XXTRA32.EXE and runs this copy of the worm. The copy will then attempt to delete the original file. In order to run each time a user logs in, W32/Rbot-WD will set the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
mark the service
xxtra32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
mark the service
xxtra32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
mark the service
xxtra32.exe
The worm runs continuously in the background providing backdoor access to the infected computer over IRC channels.
W32/Rbot-WD will set the following registry entries in order to disable DCOM and close restrictions on IPC$ shares:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
W32/Rbot-WD is capable of altering the following registry entry to restrict anonymous enumeration of SAM accounts:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymousSAM
W32/Rbot-WD can add and delete network shares and users on the infected computer. The worm can also change the network logon rights of accounts in the local system policy.
|
