Techknock

Anti-virus experts at Sophos are warning computer users about a new worm that has the capability to use webcams to spy on them in their home or workplace.

The W32/Rbot-GR worm spreads via network shares, exploiting a number of Microsoft security vulnerabilities, installing a backdoor Trojan horse as it travels.

Once installed on an infected computer remote hackers can easily gain access to the information on the PC’s hard drive and steal passwords, as well as spy on innocent users via their webcam and microphone.

Graham Cluley, Senior Technology Consultant for Sophos said,

“More and more hackers are interested in spying on the people they manage to infect with their worms and Trojan horses. In the workplace, this worm can monitor opens up the possibilities of industrial espionage. At the home it is equivalent to a Peeping Tom who invades your privacy by peering through your curtains. If your computer is infected and you have a webcam plugged in, then everything you do in front of the computer can be seen, and everything you say can be recorded.

With many home users keeping poorly-defended PCs in their bedroom, there is considerable potential for abuse. The message is simple – keep your PC protected against the latest threats with anti-virus software and firewalls, and if in any doubt unplug your webcam when you’re not using it.”

Sophos believes that the Rbot-GR worm is evidence of a growing trend of more and more malware spying on innocent home computer owners and poorly-protected businesses.

How to get rid of it?

First thing you need to do is remove worm from your system and then you will also need to edit the following registry entries, if present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type ‘Regedit’ and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the ‘Registry’ menu, click ‘Export Registry File’. In the ‘Export range’ panel, click ‘All’, then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Updates = systemc32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Updates = systemc32.exe

and delete them if they exist.

Each user has a registry area named HKEY_USERS\\. For each user locate the entry:

HKCU\\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Updates = systemc32.exe

and delete it if it exists.

Close the registry editor.

• Download and install the Microsoft patches mentioned. On standalone computers, update with all relevant security patches from Windows update.
• Check your administrator passwords and review network security.