W32/Nirbot Worm

 Information about the W32/Nirbot Worm:

W32/Nirbot is a worm. The worm will infect Windows systems and spreads through know vulnerabilities.

The worm scans for vulnerable machines on the network, and uses the following vulnerabilities to spread.

Microsoft Windows Server Service Buffer Overflow (MS06-040)
Symantec Client Security and Symantec Antivirus Elevation of privilege vulnerability (SYM06-010)
Weak password exploitation of SQL servers.
Weak password exploitation of network shares.

Upon execution, the worm creates a copy of itself named zlclint.exe in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm checks if a debugger is present on the system and quits executing if present. This is done to prevent researchers from debugging the worm.

The worm creates the following mutexes to ensure that only one instance of the worm is running on the computer.

p3n1z
DBWinMutex

The worm also has some back door capabilities. It opens random TCP ports to connect to 69.181.7.xxx IRC server and waits for commands from a remote user. Once a connection is established, it executes the following commands on the infected system.

Gather system information
Scan network for machines to infect
Launch a TFTP, HTTP server and SOCKS4 proxy
Download and Execute files.
Update worm
Uninstall worm

This worm first appeared on March 11, 2007.

 Other names of W32/Nirbot Worm:

This Worm is also known as W32/Nirbot.worm.