W32/Randon-AO

Category: Viruses and Spyware
Type: Win32 worm
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Randon-AO is a multi-component network worm.

W32/Randon-AO contains an IRC backdoor that allows a remote intruder to gain access to and control over the computer.

W32/Randon-AO may attempt to spread to network shares and through the LSASS (MS04-011) vulnerability. W32/Randon-AO is a multi-component network worm.

W32/Randon-AO contains an IRC backdoor that allows a remote intruder to gain access to and control over the computer.

W32/Randon-AO may attempt to spread to network shares and through the LSASS (MS04-011) vulnerability.

When W32/Randon-AO is installed the following files are created:

<Windows folder>\Abero\Winp\AERVICESN.DAT - data file
<Windows folder>\Abero\Winp\AERVICESN.exe - Troj/Glitch-J
<Windows folder>\Abero\Winp\AERVICESNA.exe - mIRC application
<Windows folder>\Abero\Winp\X-ScanCfg.ini - data file
<Windows folder>\Abero\Winp\calcu.exe - process viewer application
<Windows folder>\Abero\Winp\dat\config.ini - data file
<Windows folder>\Abero\Winp\dat\language.ini - data file
<Windows folder>\Abero\Winp\dat\nt_pass.dic - data file
<Windows folder>\Abero\Winp\dat\nt_user.dic - data file
<Windows folder>\Abero\Winp\dat\os.finger - data file
<Windows folder>\Abero\Winp\dat\port.ini - data file
<Windows folder>\Abero\Winp\dat\rpc.ini - data file
<Windows folder>\Abero\Winp\dl.exe - Troj/RpcLsa-A
<Windows folder>\Abero\Winp\eoputr.exe - application used to hide display windows
<Windows folder>\Abero\Winp\h1.bat - batch file used to modify file attributes
<Windows folder>\Abero\Winp\h2.bat - batch file used to modify file attributes
<Windows folder>\Abero\Winp\ipcfg.exe - FTP server application
<Windows folder>\Abero\Winp\mirc.ini - data file
<Windows folder>\Abero\Winp\plugin\090-ntpass.xpn - network scanning application
<Windows folder>\Abero\Winp\psexec.exe - process launching application
<Windows folder>\Abero\Winp\rconnect.conf - data file
<Windows folder>\Abero\Winp\roudSTID.EXE - network scanning application
<Windows folder>\Abero\Winp\rty.ini - data file
<Windows folder>\Abero\Winp\skerr.dll - W32/Randon-AO
<Windows folder>\Abero\Winp\van32.eXe - application used to hide display windows
<Windows folder>\Abero\Winp\xpxp.exe - Troj/Apher-Q

The following registry entry is created to run AERVICESN.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AERVICESN
<Windows folder>\Abero\winp\AERVICESN.exe

The following patches for the operating system vulnerabilities exploited by W32/Randon-AO can be obtained from the Microsoft website:

MS04-011.