W32/Rbot-DL is a network worm and backdoor Trojan for the Windows platform. It allows a malicious user remote access to an infected computer.
The worm copies itself to a file named winsyst.exe in the Windows system folder and creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update = winsyst.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Update = winsyst.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update = winsyst.exe.
W32/Rbot-DL spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
W32/Rbot-DL can be controlled by a remote attacker over IRC channels.
More information is at Sophos page.
7/13: Rbot-DL Empowers Remote Users
