It connects to an IRC server in order to receive remote control commands and downloads the Trojan detected as Spammer.ZV in the affected computer. It exploits the vulnerabilities LSASS and RPC DCOM, in order to spread to as many computers as possible, among other means of transmission.

Windows 2003/XP/2000/NT/ME/98/95

Rinbot.B is a worm that connects to an IRC servers in order to receive remote control commands, which allow its author to gain total control over the affected computer.

Additionally, it downloads the Trojan detected as Spammer.ZV in the affected computer.

Rinbot.B uses several different means to spread:

• Across the Internet by exploiting the vulnerabilities LSASS and RPC DCOM.
• Across networks.
• Via mapped drives.
• Through storage devices connected via USB.

It is highly recommendable to download the security patches for the vulnerabilities LSASS and RPC DCOM from the Microsoft website.

Rinbot.B is difficult to recognize, as it does not display any messages or warnings that indicate it has reached the computer.