W32/Rbot-ACC is a network worm with IRC backdoor functionality for the Windows platform. W32/Rbot-ACC may spread to remote network shares protected by weak passwords and computers vulnerable to common exploits.
The worm also opens up a backdoor, allowing unauthorized remote access to infected computers via the IRC network, while running in the background as a service process. Current Counter Spy Definitions::
anti-spyware tool that detects, deletes AND PROTECTS your personal computer Backdoor.Win32.Rbot.avy. Backdoor.Win32.RUX.Tick.40.b. Email-Worm.VBS.Santen.a
http://research.sunbelt-software.com/defdetails.aspx?prod=cse&name=405HOME |
www.esecurityplanet.com/alerts/print.php/3503821::
5/10: Rbot-ACC Worm Deletes Files. By. May 10, 2005. W32/Rbot-ACC is a network worm with IRC backdoor functionality for the Windows
http://www.esecurityplanet.com/alerts/print.php/3503821HOME |
The worm exploits vulnerabilities including: RPC-DCOM (MS04-12), LSASS (MS04-11) and WKS (MS03-049). The following patches for the operating system vulnerabilities exploited by W32/Rbot-ACC can be obtained from the Microsoft website:
Nepenthes Real Time Console::
ALERT: [Worm/Rbot.185081 worm] CSRRT sandbox. Changes on filesystem: organization the opportunity toanalyze files immediately in your own environment.
http://nepenthes.csrrt.org:10080/nepenthes/index.php?hash=28ef6437f52428f6c1d7b&v=1HOME |
Developer News: A New Fight Against ID Theft::
W32/Rbot-GMJ is a worm for the Windows platform that allows unauthorized remote access to 10. 4/23: Validin Worm Infects .Html Files; Deletes .Gho Files
http://developer-news.blogspot.com/2007/04/new-fight-against-id-theft.htmlHOME |
MS02-039
MS04-011
MS04-012
W32/Rbot-ACC can receive commands from a remote intruder to delete network shares, log keypresses, participate in DDoS attacks, scan other computers for vulnerabilities, steal passwords, steal registration keys for computer games, create administrator accounts, terminate firewall and anti-virus processes and capture video from webcameras attached to the computer.
Browse Startup Application Knowledge Base::
Added by the RBOT-ABG WORM! *Microsoft Update (ctxma.exe) Spyware, Adware, Trojan careful with the registry - it never deletes a registry entry if this could harm
http://www.windowsstartup.com/wso/browse.php?l=3&start=375&end=400HOME |
More information can be found at this Sophos page.
Pre-Article:5/10: Rbot-ACE Worm Spreads Via Shares
Next-Article:5/10: Mytob-CX Worm Connects to IRC Server |