12/18: Rbot-GSK Worm Uses Weak Passwords to Spread

W32/Rbot-GSK is a worm with IRC backdoor functionality for the Windows platform.

W32/Rbot-GSK runs continuously in the background, providing a backdoor server that allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Rbot-GSK spreads to remote network shares protected by weak passwords and to computers vulnerable to common exploits, including LSASS (MS04-011).

When first run the worm copies itself to (Windows)\security\svchost.exe and creates the file (System)\drivers\sysdrv32.sys. This file is not malicious and can be deleted.

The file (Windows)\security\svchost.exe is registered as a new system driver service named "WinHost32Svr," with a display name of "Windows Host32 Server Service" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\WinHost32Svr

More information can be found at this Sophos page.