W32/Rbot-DT

Please follow the instructions for removing worms.

Please read the instructions for removing W32/Rbot-DT.

W32/Rbot-DT is a worm which attempts to spread to remote network shares. The worm also contains backdoor functionality, allowing unauthorized remote access to the infected computer via IRC channels while running in the background as a service process.

W32/Rbot-DT spreads to network shares with weak passwords as a result of the backdoor element receiving the appropriate command from a remote user. W32/Rbot-DT is a worm which attempts to spread to remote network shares. The worm also contains backdoor functionality, allowing unauthorized remote access to the infected computer via IRC channels while running in the background as a service process.

W32/Rbot-DT spreads to network shares with weak passwords as a result of the backdoor element receiving the appropriate command from a remote user.

W32/Rbot-DT copies itself to the Windows system folder as WINCFG32.EXE and creates entries at the following locations in the registry so as to run itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Debugger = wincfg32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Update Debugger = wincfg32.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Debugger = wincfg32.exe

W32/Rbot-DT may try to delete the C$, D$, E$, IPC$ and ADMIN$ network shares on the host computer.

W32/Rbot-DT may also drop a file named DEBUG.CRF into the root folder.