W32/Rinbot.BF is a worm. The worm will infect Windows systems and spreads using software vulnerabilities.

Upon execution, it copies itself as cnen.exe in the Windows System folder.

It modifies the registry at the following locations to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

The worm creates a mutex named CN3nA to check that only one instance of the worm runs on the infected system.

The worm downloads a malicious file from http://babsvideo.com/site and saves it as site.exe in C:.

The worm also attempts to spread to other systems on the local network by exploiting the following vulnerabilities:

Microsoft DNS Server Service Could Allow Remote Code Execution (BID 23470) on TCP port 1025
Microsoft Windows Server Service Remote Buffer Overflow Vulnerability (BID 19409) on TCP port 139
Symantec Client Security and Symantec AntiVirus Elevation of Privilege (BID 18107) on TCP port 2967

The worm opens a random port and waits for a connection from computers it has attempted to exploit. Upon successful exploitation of other system, it sends a copy of itself as C:\u.exe and executes it.

The worm also has some back door capabilities. It opens TCP port 8080 to connects to the following IRC servers to join a predetermined channel.

e.52e3bbafc627009ac13caff1200a0dbf.xxx
e.52e3bbafc627009ac13caff1200a0dbf.cn
e.52e3bbafc627009ac13caff1200a0dbf.us

This worm first appeared on April 18, 2007.

 Other names of W32/Rinbot.BF Worm:

This Worm is also known as W32.Rinbot.BF, W32/Delbot-AL.