WORM_RXBOT.CK

This worm may arrive via network shares. It may also be downloaded unknowingly by a user when visiting malicious Web sites.

It drops files and creates registry entries to enable its automatic execution at every system startup. It modifies registry entries as part of its installation routine.

This worm opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Related Items