|
Win32.Rinbot.L: Serious Threat for Symantec Users
Can you imagine having to shut down every machine on your network and then bring them back up one at a time, cleaning each machine for viruses as you go? We were recently called into a company to assist in a major worm outbreak and had to help do just that! The culprit? A new worm variant called W32.Rinbot.L
It Gets In Through Your "Protection" Software
The really insidious thing about the W32.Rinbot.L worm is that it exploits the very products you are using to protect yourself. By taking advantage of vulnerabilities in Symantec anti-virus products for both the client and Server, it catches many off guard. In the case of the above customer, the worm actually used the Symantec enterprise management console to spread itself to all of the systems it was meant to protect. This worm will also propagate itself by taking advantage of weak passwords on File Shares and SQL Servers.
If you, like many of our customers, use Symantec products for anti-virus and anti-spam, we advise you to take a look at this possible vulnerability.
What Can Happen?
If your system becomes infected, a backdoor will be created that will be able to accept commands to perform a variety of tasks, including:
- Gather system information
- Scan local network for computers to infect
- Download and execute a specified file
- Run an HTTP/FTP server
- Update itself
- Steal CD Keys
- End analysis tools such as Filemon, Regmon, Ethereal, etc.
What Should You Do?
To help protect you and your company from this variant you should take the following steps:
- Make sure all Symantec products are updated.
- Enforce strong passwords in all areas of your network
- Regularly check for and update your computers for security patches
Of course, if you have any questions about protecting yourself from this threat, don’t hesitate to call Coyote Creek Consulting at 888.269.6838.
Back to News & Events
|
|
|
