W32/Rbot-AOB

Aliases	WORM_RBOT.CAO W32.Spybot.Worm W32/Sdbot.worm.gen.h
Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


How it spreads	Network shares
Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	November 2005 (3.99)
Protection available since	15 September 2005 22:38:19 (GMT)
Detected by	All Sophos products

W32/Rbot-AOB is a worm and IRC backdoor Trojan for the Windows platform which allows a remote intruder to gain access and control over the computer.

When first run W32/Rbot-AOB copies itself to <System>\msautou.exe and creates the file <System>\svkp.sys.

The following registry entries are created to run msautou.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Automatic Update Serivce
msautou.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Automatic Update Serivce
msautou.exe

The following registry entry is set:

HKCU\Software\Microsoft\OLE
Microsoft Automatic Update Serivce
msautou.exe

Get reports about the latest virus and spyware threats delivered to your computer