W32/Rinbot.A is a worm. The worm will infect Windows systems and spreads using known vunerabilites.

The worm opens a back door, connects to IRC server, and awaits commands from an attacker.

Upon execution, it copies itself as jwmngr.exe in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm attempts to copy itself to the IPC$ network share. If this is password protected it tries to gain access using user names and passwords from a predefined list.

The worm opens a back door and attempts to connect to z3n.phatcamp.org IRC server using TCP port 8080.

The worm allows an attacker to perform the following actions on the compromised computer;

Update itself
Run a socks4 proxy
Gather system information
Run an HTTP or FTP server
Steal CD keys for certain games
Download and execute a specified file
Scan local network for machines to infect
Perform a DDoS attack on a specified host

This worm first appeared on February 18, 2007.

 Other names of W32/Rinbot.A Worm:

This Worm is also known as W32.Rinbot.A.