[virusinfo] W32/Rbot-LD

From: "Mike" <mikebike@xxxxxxxxx>
To: virusinfo@xxxxxxxxxxxxx
Date: Wed, 30 Mar 2005 09:56:45 -0800
From; Sophos Alert System:

Name: W32/Rbot-LD
Aliases: WORM_RBOT.MW, Backdoor.Win32.Rbot.bf, W32/Sdbot.worm.gen.x
Type: Win32 worm
Date: 30 March 2005

A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the May 2005 (3.93) release of Sophos Anti-Virus.

Customers using EM Library, PureMessage or any of our Sophos
small business solutions will be automatically protected at
their next scheduled update.

At the time of writing, Sophos has received no reports from
users affected by this worm. However, we have issued this
advisory following enquiries to our support department from
customers.


Note: The IDE issued for Troj/LowZone-D at 07:56:34GMT on 4
October 2004 also contained detection for W32/Rbot-LD,
W32/Rbot-LF, Troj/LowZone-D, W32/Rbot-LJ, Troj/Banker-V,
Troj/Dloader-CR, Troj/Dloader-KO, Troj/Agent-AW, Troj/PWSLmir-F,
and W32/Rbot-LK. This IDE has now been updated to enhance
detection of Troj/LowZone-D.


Information about W32/Rbot-LD can be found at:
http://www.sophos.com/virusinfo/analyses/w32rbotld.html

W32/Rbot-LD is a worm which attempts to spread to remote network shares and 
allows unauthorised remote access to the computer via IRC channels. 
W32/Rbot-LD spreads to network shares with weak passwords and via network 
security exploits as a result of the backdoor Trojan element receiving the 
appropriate command from a remote user. 
W32/Rbot-LD copies itself to the file spools.exe in the Windows system folder 
and creates entries at the following locations in the registry so that the worm 
is run when a user logs on to Windows: 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Print Spooler = spools.exe 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Print Spooler = spools.exe 
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Print Spooler = spools.exe 


This IDE file also includes detection for:

W32/Rbot-LF
http://www.sophos.com/virusinfo/analyses/w32rbotlf.html
Troj/LowZone-D
http://www.sophos.com/virusinfo/analyses/trojlowzoned.html
W32/Rbot-LJ
http://www.sophos.com/virusinfo/analyses/w32rbotlj.html
Troj/Banker-V
http://www.sophos.com/virusinfo/analyses/trojbankerv.html
Troj/Dloader-CR
http://www.sophos.com/virusinfo/analyses/trojdloadercr.html
Troj/Dloader-KO
http://www.sophos.com/virusinfo/analyses/trojdloaderko.html
Troj/Agent-AW
http://www.sophos.com/virusinfo/analyses/trojagentaw.html
Troj/PWSLmir-F
http://www.sophos.com/virusinfo/analyses/trojpwslmirf.html
W32/Rbot-LK
http://www.sophos.com/virusinfo/analyses/w32rbotlk.html

Download the IDE file from:
http://www.sophos.com/downloads/ide/rbot-ld.ide

Download all the IDE files available for the current version of 
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:

Zip file:
http://www.sophos.com/downloads/ide/ides.zip

Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe

Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html

*********** MIKE"S REPLY SEPARATOR  ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages  http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance  and OWTA Charter Member
[virusinfo] W32/Rbot-LD

Other related posts:
