[virusinfo] W32/Rbot-AEF
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Thu, 02 Jun 2005 09:20:09 -0700
From; Sophos Alert System:
Name: W32/Rbot-AEF
Aliases: W32.Spybot.Worm
Type: Win32 worm
Date: 2 June 2005
Sophos has issued protection for W32/Rbot-AEF.
At the time of writing, Sophos has received no reports from
users affected by this worm. However, we have issued this
advisory following enquiries to our support department from
customers.
Customers using EM Library, Enterprise Console, PureMessage or
any of our Sophos small business solutions will be automatically
protected at their next scheduled update.
Information about W32/Rbot-AEF can be found at:
http://www.sophos.com/virusinfo/analyses/w32rbotaef.html
W32/Rbot-AEF is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AEF runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.
When first run W32/Rbot-AEF copies itself to <System>\winsys.exe.
The following registry entries are created to run winsys.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows System
WINSYS.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows System
WINSYS.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Windows System
WINSYS.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows System
WINSYS.exe
Registry entries are set as follows:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Windows System
WINSYS.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Windows System
WINSYS.exe
HKCU\Software\Microsoft\OLE
Windows System
WINSYS.exe
HKLM\SOFTWARE\Microsoft\Ole
Windows System
WINSYS.exe
Sophos's anti-virus products include Genotype detection technology, which can
proactively protect against new threats without requiring an update. Sophos
customers have been protected against W32/Rbot-AEF (detected as W32/Rbot-Fam)
since version 3.88.
The W32/Rbot-AEF virus identity file (IDE) includes detection for:
W32/Rbot-AEG
http://www.sophos.com/virusinfo/analyses/w32rbotaeg.html
Troj/Banker-CZ
http://www.sophos.com/virusinfo/analyses/trojbankercz.html
Troj/Dloader-OE
http://www.sophos.com/virusinfo/analyses/trojdloaderoe.html
Troj/Bdoor-IK
http://www.sophos.com/virusinfo/analyses/trojbdoorik.html
Customers with 3.xx or lower versions of Sophos Anti-Virus,
who are not running EM Library, can manually download the IDE
for W32/Rbot-AEF from:
http://www.sophos.com/downloads/ide/rbot-aef.ide
Read about how to use IDE files at
http://www.sophos.com/support/knowledgebase/article/363.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Rbot-AEF
