Malicious Software Encyclopedia: Win32/Wootbot
Published:
June 24, 2005
Win32/Wootbot is a family of network worms that targets certain versions of Microsoft Windows. The worm spreads to writeable network shares as well as MySQL and Microsoft SQL Server application servers. It also spreads by exploiting various Windows vulnerabilities. The worm has a backdoor component that connects to an IRC server and joins a specific channel to receive commands from attackers.
On This Page
Threat Overview
| Class/type | Worm - Network
Trojan - Backdoor
|
| Discovered | September 9, 2004 |
| Circulating | Yes |
| Affected operating systems | Windows NT 4.0
Windows 95
Windows 2000
Windows XP
Windows Server 2003
|
| Affected software | Microsoft SQL Server 2000 Desktop Engine (MSDE 2000)
|
| Infection rating | Medium |
| Recovery difficulty | Moderate |
| Damage rating | Medium |
| Transmission rating | Medium |
Aliases (Also Known As)
Different antivirus vendors may be using different names to refer to this malicious software. Here are some of the names currently in use by antivirus software vendors participating in the Microsoft Virus Information Alliance (VIA):
CA:
Win32.ForbotMcAfee:
W32/Sdbot.wormSymantec:
W32.Spybot.WormTrend Micro:
WORM_FORBOTTrend Micro:
WORM_WOOTBOT
Learn more about the
Microsoft Virus Information Alliance.
Related Security Bulletins
The following Microsoft Security bulletins are related to this issue:
MS03-026 - Buffer Overrun In RPC Interface Could Allow Code Execution (823980)MS04-011 - Security Update for Microsoft Windows (835732)MS04-045 - Vulnerability in WINS Could Allow Remote Code Execution (870763)Technical Analysis
When Win32/Wootbot runs, it creates a copy of itself in %windir% or the system folder. The worm may set the file attributes of the copied file to hidden and system.
The worm may add a value to one or more registry keys, which causes the worm to run each time Windows starts. Some variants create a Windows system service for this purpose.
Win32/Wootbot can connect to an internet relay chat (IRC) server and join a specific IRC channel to receive commands that can include:
Several Windows vulnerabilities allow the worm to spread to other computers. For example, the worm can exploit the Windows Local Security Authentication Server (LSASS) service process vulnerability to create a command shell on a remote computer. The worm then uses the command shell to copy itself to that computer. This vulnerability is fixed in Microsoft Security Bulletin MS04-011.
Win32/Wootbot can also spread to writeable network shares and to MySQL and Microsoft SQL Server application servers by trying weak administrator passwords. After it gains access, the worm copies itself to the remote computer and runs the copy.
Some variants of Win32/Wootbot attempt to spread through a backdoor that is opened by a variant of the Optix family of backdoor Trojans. Some Win32/Wootbot variants terminate services and processes related to computer security.
How to Prevent Infection
Take the following steps to help prevent infection on your system:
Enable a firewall on your computer
Get the latest computer updates
Use up-to-date antivirus software
Use strong passwords
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft® Windows® XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
Click Start, and click Control Panel.
Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
Highlight a connection that you want to help protect, and click Change settings of this connection.
Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows® XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates
Click Start, and click Control Panel.
Click Performance and Maintenance. If you do not see Performance and Maintenance , click Switch to Category View.
Click System.
Click Automatic Updates, and select Keep my computer up to date.
Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection.
Use strong passwords
A strong password is one that is at least eight characters, includes a combination of letters, numbers, and symbols and is easy for you to remember, but difficult for others to guess. Weak passwords include any words in the dictionary, names, dates, consecutive letters or numbers, common words with symbol substitutions (for example, p@ssw0rd), and so on.
How to Tell If Your Computer Is Infected
Your computer may be infected with a variant of Win32/Wootbot if any of the following symptoms appear:
An LSA Shell error report dialog box like the following is displayed:
A system shutdown dialog box is displayed before your computer reboots unexpectedly. The following examples indicate computer shutdown due to unexpected termination of the system process lsass.exe or the Remote Procedure Call (RPC) service.
How to Recover from Infection
Automatic Recovery
To attempt to automatically remove this threat, run one of the following removal tools:
Transmission Methods
| Method | Description |
|---|
| Exploits Vulnerability | Can exploit several Windows vulnerabilities to spread to a remote computer. |
| Network Shares | Can spread to writeable network shares that have weak passwords. |
