Malware type: Worm

Aliases: Backdoor.Win32.Rbot.ayi (Kaspersky), W32/Sdbot.worm.gen.ca (McAfee), W32.Spybot.Worm (Symantec), Worm/Rbot.166912 (Avira), Mal/Packer (Sophos),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Description: 

This worm takes advantage of the following Windows vulnerabilities:

• Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) Vulnerability
• IIS5/WEBDAV Buffer Overflow Vulnerability
• RPC Locator Vulnerability
• LSASS Vulnerability

For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:

• Microsoft Security Bulletin MS03-026
• Microsoft Security Bulletin MS03-001
• Microsoft Security Bulletin MS03-007
• Microsoft Security Bulletin MS04-011

It also attempts to log on to systems using a list of user names and passwords. It drops a copy of itself into accessible machines.

This worm has backdoor capabilities. It executes commands sent in via Internet Relay Chat (IRC) and can be used to launch a Denial of Service (DoS) attack against specified target sites.

It steals the CD keys of popular game applications.

This worm runs on Windows 95, 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jun. 19, 2004 4:54:58 AM GMT -0800
Description updated: Jun. 19, 2004 5:19:34 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.