W32/Rbot-GDD

Category: Viruses and SpywareProtection available since:03 Feb 2007 00:00:00 (GMT)
Type: Win32 wormLast Updated:08 Mar 2007 00:00:00 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Rbot-GDD is a network worm with IRC backdoor functionality for the Windows platform.

W32/Rbot-GDD spreads by exploiting common network vulnerabilities.

W32/Rbot-GDD allows a remote attacker to gain access and control over the infected computer using IRC channels.

When first run W32/Rbot-GDD copies itself to <System>\algose32.exe and creates the following registry entries to run algose32.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Offices Monitorse
<System>\algose32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Offices Monitorse
<System>\algose32.exe

W32/Rbot-GDD sets the following registry entries in order to secure the infected computer against further exploits:

HKLM\SOFTWARE\Microsoft\Ole\
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
restrictanonymous
1