W32.Rinbot.A

W32.Rinbot.A is a worm that opens a back door, connects to an IRC server, and awaits commands from an attacker. The worm spreads using known vulnerabilities.

Protection

• Initial Rapid Release version February 17, 2007
• Latest Rapid Release version February 6, 2010 revision 034
• Initial Daily Certified version February 17, 2007
• Latest Daily Certified version February 6, 2010 revision 035
• Initial Weekly Certified release date February 21, 2007

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium
• Payload: Opens a back door on the compromised computer.
• Releases Confidential Info: May steal CD keys from certain video games.

Distribution

• Distribution Level: High
• Ports: 8080
• Shared Drives: Copies itself to IPC$ shares.