Published Mar 21, 2005 | Updated Sep 15, 2017

Backdoor:Win32/Rbot

Severe |Detected with Windows Defender Antivirus

Aliases: Win32/IRCBot.worm.variant (AhnLab) W32/Ircbot.1!Generic (Command) Win32/Rbot!generic (CA) Win32/Rbot.Y (ESET) Backdoor.Win32.Rbot.gen (Kaspersky) W32/Sdbot.worm.gen.g (McAfee) W32/Spybot.BPUM (Norman) W32/Rbot-GR (Sophos) W32.Spybot.Worm (Symantec) WORM_SPYBOT.GEN (Trend Micro)

Summary

Backdoor:Win32/Rbot is a family of backdoor Trojans that allows attackers to control infected computers. After a computer is infected, the Trojan connects to a specific IRC server and joins a specific channel to receive commands from attackers. Commands can instruct the Trojan to spread to other computers by scanning for network shares with weak passwords, exploiting Windows vulnerabilities, and spreading through backdoor ports opened by other families of malicious software. The Trojan can also allow attackers to perform other backdoor functions, such as launching denial of service (DoS) attacks and retrieving system information from infected computers.
Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.
Follow us