W32/Rbot.CLS Worm

 Information about the W32/Rbot.CLS Worm:

W32/Rbot.CLS is a worm. The worm will infect Windows systems. The worm spreads through MSN Messenger and shared network drives.

This worm exploits RPCSS and LSSAS vulnerabilities present in Windows as explained by Microsoft Security Bulletin MS03-039 and MS04-011.

This worm is downloaded and executed by W32/Kelvir.DV Worm.

Upon execution, the worm copies itself as swchost.exe in the Windows System folder.

It modifies the Windows registry at the following locations to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Microsoft has released the patch for MS04-011 vulnerability. It can be downloaded from the following link;

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on October 12, 2005.

 Other names of W32/Rbot.CLS Worm: