W32/Rbot.OU Worm

 Information about the W32/Rbot.OU Worm:

W32/Rbot.OU is a worm. The worm will infect Windows systems. The worm spreads through email and P2P software.

The subject of the infected mail will be any one of the following;

Error
Server Report
hi
hello
Mail Delivery System
Mail Transaction Failed
Status

The body of the infected mail will be any one of the following;

test
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
The message contains Unicode characters and has been sent as a binary attachment.

The infected attachment will be any one of the following;

file
body
doc
data
test
message
document
readme
text

with any one of the following extension.

exe
cmd
bat
pif
scr

Upon execution of the infected attachment, the worm copies itself as speeder.exe in Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm copies all available email address from Windows Address book and Temporary Internet Files folder.

The worm mails itself to these addresses using its own SMTP engine.

The worm propogates through P2P software by copying itself to the shared folders used by P2P software using the following names.

ACDSee 9.com
Ahead Nero 7.com
Adobe Photoshop 9 full.com
Kaspersky Antivirus 5.0.com
Matrix 3 Revolution English Subtitles.scr
KAV 5.0.com
Microsoft Office 2003 Crack, Working!.pif
Microsoft Windows XP, WinXP Crack, working Keygen.pif
Microsoft Office XP working Crack, Keygen.pif
Opera 8 New!.com
Porno, sex, oral, anal cool, awesome!!.scr
Porno pics arhive, xxx.scr
Porno Screensaver.scr
Serials.txt.bat
Windown Longhorn Beta Leak.pif
WinAmp 5 Pro Keygen Crack Update.com
WinAmp 6 New!.com
Windows Sourcecode update.doc.pif
XXX hardcore images.scr

The worm also has backdoor capabilities that connect to IRC Internet Relay Chat server using variable ports.

The worm also takes advantage of the following vulnerabilities.

IIS/WebDAV vulnerability
Buffer Overrun In RPCSS Service Vulnerability
Windows LSASS vulnerability
RPC/DCOM vulnerability

This worm first appeared on June 03, 2006.

 Other names of W32/Rbot.OU Worm: