http://www.f-secure.com/v-descs/netdisinf.shtml
The executable is a file of around 10KB.
Installation to system
When the backdoor's file is activated on a computer, it copies
its file to Windows System folder as 'wintbpx.exe' and then starts
the copied file. Then it adds the following registry entries to ensure
that it is started when a user logs on or the system is restarted:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wintbpx" = "wintbpx.exe"
Spreading using PnP exploit
The backdoor has the ability to spread to remote computers using
the PNP exploit on port 445. If the attack is successful a shell (cmd.exe)
is started on port 8563. Through the shell port, the worm sends a tftp script
which instructs the remote computer to download and execute the worm from the
attacker computer using built-in TFTP server listening on port 69.
Here's the summary of the ports used in attack:
Port 445
- The worm scans for systems vulnerable to PnP exploit through this port
Port 69
- TFTP server port on infected systems
Port 8563
- The command shell port opened by the exploit code
Please see the following page for detailed information on the vulnerability:
http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx
Terminating processes
The backdoor tries to terminate and delete the files of the following processes:
wintbp.exe (Net-Worm.Win32.Bozori.a) [uses MS05-039 exploit]
winpnp.exe (Backdoor.Win32.Rbot.ym) [uses MS05-039 exploit]
mousebm.exe (Backdoor.Win32.IRCBot.es) [uses MS05-039 exploit]
csm.exe (Net-Worm.Win32.Mytob.cf / Zotob.B) [uses MS05-039 exploit]
botzor.exe (Net-Worm.Win32.Mytob.cd / Zotob.A) [uses MS05-039 exploit]
pnpsrv.exe (Backdoor.Win32.Rbot.yk) [uses MS05-039 exploit]
svnlitup32.exe (Backdoor.Win32.SdBot.yx) [uses MS05-039 exploit]
upnp.exe (Backdoor.Win32.Codbot.ab) [doesn't use MS05-039 exploit]
service32.exe
llsrv.exe
system32.exe
Bot functionality
The backdoor connects to IRC server 72.20.41.139, joins an IRC channel
called '#tbp' and creates a bot there. The attacker can instruct the
bot to execute the following actions:
Exit bot
Remove bot
Download and execute files from the Internet
Detection for this malware was published on August 17th, 2005 in
the following F-Secure Anti-Virus updates:
[FSAV_Database_Version]
Version=2005-08-17_02
Technical Details:
Jarkko Turkulainen, August 17th, 2005;
Description Updated:
Alexey Podrezov, August 18th, 2005;
F-Secure Corporation
![](/images/pixel.gif"){kind=tracking}
