|
|
RBot.Lynx Worm Information
| Name: |
RBot.Lynx |
| Category: |
Worm |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
RBot.Lynx is a worm that attempts to spread using port 445 in order to exploit vulnerabilities in the Microsoft Windows operating systems.
This threat randomly scans IP addresses looking for open port 445. RBot.Lynx also opens a backdoor connection on port 80 to obtain updates/and or instructions from hackers to conduct other malicious activities.
|
| Signatures:
|
process: update.exe: MD5 Hash: 9ace3a128931eb960d9...
process: ibm00001.exe: MD5 Hash: d005f6fff0cba1327ae.. |
| Type: |
Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do). |
Top Worm Visited Pages:
Wukill.mstray - Alias: Win32/HLLW.Wukill - 287 visits
Rbot - Alias: Backdoor.Rbot.Gen - 274 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 227 visits
Trojan.Downloader.winstall - 180 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 89 visits
Worm.P2P.SpyBot.gen - 56 visits
Gaobot - 43 visits
Win32/Darby.O - 42 visits
Worm.Trilissa.e - 42 visits
JS.Lame - Alias: HTML.Lame - 40 visits
Random Worm Pages:
Gaobot.ns
IRC.Worm.Ministry.595 - Alias: IRC/Krashmag
Rbot.MShelp
Worm.Fintas.a
Worm.Brit.e - Alias: VBS/Chick.e@M virus
IRC.Worm.Momma.c
RBot.Lynx
VBS.Charlene.e
RBot.snlogsvc
Win32.HLLW.Lovgate.C
|
|
