W32/Rontokbro.J is an email worm. The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject and body of the infected mail will be Blank.

The infected attachment will be Kangen.exe.

Upon execution of the infected attachment, the worm copies eksplorasi.exe and sempalong.exe to the Windows installed folder and Setting.scr to the Windows System folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

php, eml, html, wab, txt, asp, csv and doc.

The worm mails itself to these addresses using its own SMTP engine.

This worm first appeared on October 25, 2005.

 Other names of W32/Rontokbro.J Worm:

This Worm is also known as W32.Rontokbro.K@mm, W32/Rontokbro.gen@MM, WORM_RONTOKBRO.J.