Samsung's Best HDTV's - Click Here
- Servers
- Desktops
- Laptops
- Tablet PCs
- PDAs
- Smart phones
- Digital cameras
- Camcorders
- Printers & multifunction devices
- Scanners
- Copiers
- Monitors & projectors
- Hard drives & burners
- Peripherals
- Productivity
- Accounting & finance
- Data management
- Graphics & publishing
- Web publishing
- Operating systems
- Security & utilities
- Downloads & trial software
- Handheld software
- Instant messaging
- Cell phones & plans
- Voice over Internet
- Telephones
- Routers & gateways
- Wireless networking
- Network adapters
- Internet access
- Web hosting
- Domain search
- Hotspot Zone
- Desktops
- Laptops
- Servers and storage
- PDAs
- Cell phones
- Monitors & projectors
- Printers
- Networking and wireless
- Security and utility software
- Productivity software
- Access, hosting, and services
- All business buying guides
Rob Vamosi's
award-winning
column on Internet threats and how to counter them
Delivered Mondays
CNET Security Center: Your complete source of antivirus and Internet security information.
This variation of Rinbot exploits the latest DNS server flaw in Windows.
By Robert Vamosi (April 17, 2007)
Date first reported: 04/17/07
CME Number: NA
Software vulnerable: Microsoft Windows
What it does: Uses infected computers to locate and exploit vulnerabilities in Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2.
Recommendations: None
Exploit code available: Yes
Vendor patch available: No
Antivirus vendor McAfee says this version of Rinbot, when executed, adds the following files to an infected system:
mozila.exe (W32/Nirbot.worm!RpcDns)
mdnex.exe (W32/Nirbot.worm!83E1220A)
These files, in turn, open and contact a botnet command and control channel at the following IRC server(s) on TCP port 8080:
(blocked).rofflewaffles.us
(blocked).anti-viral.us
(blocked).wayne.brady.gonna.have.to.chokeabitch.us
Rinbot also contacts the following URL(s) for further downloads:
hxxp://209.97.218.21/(blocked)/mdnex.exe
hxxp://209.97.218.21/(blocked)/mozila.exe
hxxp://www.tgi(blocked).com/radi.exe
McAfee says Rinbot uses the following commands to acquire information of RPC enabled hosts:
.scan.stop -s;.scan.start DNS 25 -s;
.scan.start DNS 25 -a -s;
.scan.start DNS x.x.x.x 25 -s;
Additional Resources:
Microsoft: Advisory 934864 on the RPC DNS server flaw
NIST: CVE-2007-1748
CNET News.com: Cybercrooks exploiting new Windows DNS flaw
McAfee: W32/Nirbot.worm!83E1220A
Sophos: Delbot
Symantec: W32.Rinbot.BC
Trend Micro WORM_VANBOT.GC
