W32/Rinbot.H is a worm. The worm will infect Windows systems and spreads using software vulnerabilities and network shares.

The worm usually arrives as a dropped file of other malware. It may also be downloaded from the Internet when the user visits some malicious websites.

Upon execution, it copies itself as MSTSCC.EXE in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It also modifies the registry at the following location to bypasses the the Windows firewall;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Shared Access\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

The worm attempts to copy itself to the IPC$ network share. If this is password protected it tries to gain access using user names and passwords from a predefined list.

The worm also uses the advantage of the SQL Server 7.0 Service Pack Password vulnerability to propagate across networks.

The worm also has some back door capabilities. It opens random TCP ports to connects to a certain IRC server and waits for commands from a remote user. Once a connection is established, it executes the following commands on the infected system.

Download and upload files
Flush the DNS cache
List, start, or terminate processes
Log keystrokes
Perform basic HTTP and FTP operations to download and execute files
Redirect ports
Retrieve cached passwords
Retrieve system information

This worm first appeared on March 07, 2007.

 Other names of W32/Rinbot.H Worm:

This Worm is also known as WORM_Rinbot.H .