W32/Rinbot.AN is a worm. The worm will infect Windows systems and spreads using software vulnerabilities and network shares.

The worm usually arrives as a dropped file of other malware. It may also be downloaded from the Internet when the user visits some malicious websites.

Upon execution, it copies itself as bootchk.exe in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm attempts to copy itself to the IPC$ network share. If this is password protected it tries to gain access using user names and passwords from a predefined list.

The worm also uses the advantage of the Microsoft Windows Server Service Remote Buffer Overflow Vulnerability to propagate across networks.

The worm opens TCP port 4095 to connect to 0s.hybridtx.com IRC server.

The worm may also open a backdoor on a random port allowing a remote attacker to perform the following tasks:

Update itself
Steal Cd Keys
Run an http/ftp server
Gather system information
Download and execute a specified file
Scan local network for machines to infect

This worm first appeared on March 30, 2007.

 Other names of W32/Rinbot.AN Worm:

This Worm is also known as W32.Rinbot.AN, W32/Delbot-AB.