|
|
RBot.MPWE Trojan Information
| Name: |
RBot.MPWE |
| Category: |
Trojan |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
RBot.MPWE hides itslef as Windows Media Player. RBot.MPWE can be controlled by a remote attacker over IRC channels.
RBot.MPWE spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
The backdoor component of RBot.MPWE can be instructed by a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
|
| Signatures:
|
process: mpwe.exe: MD5 Hash: fd6faae9464af5a7ccf.. |
| Type: |
Trojan - A Trojan software is any software on a user's computer that the user is not aware or intentionally installed. Most Trojan software is designed to perform some sort of actions that could jeopardize the user's security or privacy. |
Top Trojan Visited Pages:
Tro.Downloader.loadadv - 411 visits
Enable Regedit - 195 visits
Java.ClassLoader.Dummy.d - 186 visits
Trojan.BankerSpy - 179 visits
RBot.steam - 86 visits
Startup.NameShifter.Xgtray - 77 visits
Tro.Bagle.SP - 59 visits
LRPatch Trojan - 58 visits
Trojan.BHO.NameShifter.EZ - 55 visits
Tro.YourStartingPage - 54 visits
Random Trojan Pages:
Life.Batch
OuterLimit - Alias: Outer.1317, Trojan.OuterLimit, Univ.ow/a
Trojan.Startup.NameShifter.GC
SennaSpy Trojan
Desktop Spy Agent
Grabbag
QFat20 Trojan - Alias: Loader HST, QZap120
RBot.mswsck32 - Alias: Microsoft Winsocks 32 Controller
Fosen - Alias: BackDoor-FM trojan, BackDoor-FM, Backdoor.Fosen
Ren_Bat
|
|
