Troj/Rbot-ACT

Category: Viruses and Spyware
Type: Trojan
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Rbot-ACT is a Windows Trojan which contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels.

When run Troj/Rbot-ACT copies itself to the Windows System folder as msnmcgrs.exe and creates the following registry entries to run itself on user logon:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
strmsnnrs
msnmcgrs.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
strmsnnrs
msnmcgrs.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
strmsnnrs
msnmcgrs.exe

Once installed, Troj/Rbot-ACT will attempt to download files from the internet and run them and acts as a HTTP proxy when instructed to do so by a remote attacker.

download Try Sophos products for free
Download now