W32/Rbot-AII

Category: Viruses and Spyware
Type: Win32 worm
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Rbot-AII is a network worm and IRC backdoor Trojan for the Windows platform.

W32/Rbot-AII runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

W32/Rbot-AII can spread to remote network shares protected by weak passwords.

When first run W32/Rbot-AII copies itself to <System>\MS-DOS.PIF.

The following registry entries are created to run explorer.pif on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS-DOS Service
MS-DOS.pif

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
MS-DOS Service
MS-DOS.pif