3/24: Rbot-DP an IRC Backdoor Trojan
March 24, 2005

W32/Rbot-DP is an IRC backdoor Trojan with spreading capability. W32/Rbot-DP copies itself into the Windows system folder and sets the following registry entries to run itself automatically when Windows starts up:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft DirectX
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft DirectX
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Microsoft DirectX

W32/Rbot-DP logs onto a predefined IRC server and waits for backdoor commands. When receives the appropriate backdoor command W32/Rbot-DP will attempt to spread to other computers.

More information can be found at Sophos page.