W32/Rbot-ACF

Category: Viruses and Spyware
Type: Win32 executable file virus
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Rbot-ACF is a Windows network worm which attempts to spread via network shares. The worm contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels while running in the background.

The worm spreads to network shares with weak passwords and the following operating system vulnerabilites:

LSASS (MS04-011)
RPC-DCOM (MS04-012)
WKS (MS03-049)
WebDav (MS03-007)
IIS5SSL (MS04-011)
MSSQL (MS02-039)
UPNP (MS01-059)
Dameware (CAN-2003-1030)

The worm may also spread by ports left open by other Trojans and worms.

When run W32/Rbot-ACF copies itself to the Windows System folder as a filename FTPDev.exe and creates the following registry entries to run itself on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MSFWAVTSM
FTPDev.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
MSFWAVTSM
FTPDev.exe

Once installed, W32/Rbot-ACF will attempt to perform the following actions when instructed to do so by a remote attacker:

setup a FTP server
create a SOCKS4 server
terminate threads and processes
perform port scanning on IP addresses
steal computer system hardware information
capture keystrokes
copy itself to IPC$ network shared folders
login to MS SQL servers and send EXEC commands to open a command shell
download files from the internet and run them
participate in denial of service (DoS) attacks


The following patches for the operating system vulnerabilities exploited by W32/Rbot-ACF can be obtained from the Microsoft website:

<a href=
"http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx"
target="_blank">MS04-011</a>
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx"
target="_blank">MS04-012</a>
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx"
target="_blank">MS03-049</a>
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx"
target="_blank">MS03-007</a>
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS02-039.mspx"
target="_blank">MS02-039</a>
<a href=
"http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx"
target="_blank">MS01-059</a>