W32/Rinbot.B Worm

 Information about the W32/Rinbot.B Worm:

W32/Rinbot.B is a worm. The worm will infect Windows systems, spreads through network shares and exploits system vulnerabilities.

Upon execution, it copies itself as sansv.exe in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm attempts to copy itself to the IPC$ network share. If this is password protected it tries to gain access using user names and passwords from a predefined list.

The worm opens a back door and attempts to connect to x.xerro.net IRC server using TCP port 8080.

The worm allows an attacker to perform the following actions on the compromised computer;

Set up an HTTP/FTP file server
Scan local network for computers to compromise
Gather information about the compromised computer
Steal registration information from certain software
Disable processes and services, some of which may be security-related
Download and execute files, some of which may include an updated version of the worm

The worm may spread by attacking networks shares and SQL servers with weak passwords and by exploiting the following vulnerabilities:

The Microsoft Windows Server Service Remote Buffer Overflow Vulnerability (BID 19409)
The vulnerabilities in the Microsoft SQL Server 2000 or MSDE 2000 audit (BID 5980) using UDP port 1434
Symantec Client Security and Symantec AntiVirus Elevation of privilege (BID 18107)

This worm first appeared on February 22, 2007.

 Other names of W32/Rinbot.B Worm:

This Worm is also known as W32.Rinbot.B.