Virus Description - W32/RBot.SAD Trojan

W32/RBot.SAD Trojan

Name	W32/RBot.SAD Trojan
Aliases	W32/Oscarbot.XV, Win32/AutoRun.US, Backdoor.Win32.RBot.SAD
Updated on	March 25, 2010

Virus Information - W32/RBot.SAD Trojan:

W32/RBot.SAD is a trojan. The trojan will infect Windows systems.

Upon execution, the trojan drops service.exe file in Windows\system32 folder.

The trojan modifies registry at the following locations:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run