W32/Rbot-AEU is a worm for the Windows platform.
When first run W32/Rbot-AEU copies itself to <Windows system folder>\techstart.exe.
The following registry entries are created to run techstart.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ATI Technology Startup
techstart.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
ATI Technology Startup
techstart.exe
The following registry entry is set:
HKCU\Software\Microsoft\OLE
ATI Technology Startup
techstart.exe
W32/Rbot-AEU may also attempt to delete network shares and steal CD keys of computer games.