View Single Post
Old Aug 20, 2006 | 10:13 PM
  #24  
Thrush's Avatar
Thrush
Irritating c........
20 Year Member
Liked
Loved
Community Favorite
iTrader: (1)
 
Joined: May 2003
Posts: 21,268
Likes: 147
From: The Dark Side of the Moon...
Default

Right, for a start I certainly don't like the look of this entry;

O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe

That relates to a "worm" known as W32/Rbot-BJV - W32/Rbot-BJV is a network worm with backdoor functionality for the Windows platform. W32/Rbot-BJV spreads using a variety of techniques including exploiting weak passwords on computers and exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WKS and ASN.1).

W32/Rbot-BJV can be controlled by a remote attacker over IRC channels. The backdoor component of W32/Rbot-BJV can be instructed by a remote user to perform the following functions:

start an FTP server
start a Proxy server
take part in distributed denial of service (DDoS) attacks
log keypresses
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)

The worm copies itself to a file named mssvcc.exe in the Windows system folder and creates the following registry entries to run on system startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msconfig38
mssvcc.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services
msconfig38
mssvcc.exe

But alas all is not lost! Patches for the operating system vulnerabilities exploited by W32/Rbot-BJV can be obtained from Microsoft at:

http://www.microsoft.com/technet/sec.../ms04-011.mspx
http://www.microsoft.com/technet/sec.../MS04-012.mspx
http://www.microsoft.com/technet/sec.../MS03-049.mspx
http://www.microsoft.com/technet/sec.../MS04-007.mspx
Reply