W32/Rbot-BDT

Category: Viruses and Spyware
Type: Win32 worm
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Rbot-BDT is a worm and IRC backdoor for the Windows platform.

When first run W32/Rbot-BDT copies itself to <System>\alg2.exe and creates the
file \%CurrentFolder%\aspr_keys.ini.

The following registry entries are created to run alg2.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Networking Service
alg2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Networking Service
alg2.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Networking Service
alg2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Networking Service
alg2.exe

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Networking Service
alg2.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Networking Service
alg2.exe

HKCU\Software\Microsoft\OLE
Networking Service
alg2.exe

HKLM\SOFTWARE\Microsoft\Ole
Networking Service
alg2.exe