Worm.Rbot.AATS Description

Worm.Rbot.AATS spreads by secretly copying itself across networks shares. Because Worm.Rbot.AATS is able to mutate, it is especially difficult to manually detect and remove it. Worm.Rbot.AATS may create a backdoor through which remote attackers can access a compromised PC. Additional malware programs may also be installed onto a PC by Worm.Rbot.AATS. Securing your system with an effective security application will prevent Worm.Rbot.AATS from infecting your PC.

Type: Worms

Aliases: BackDoor-EFI (McAfee), Mal/Generic-E (Sophos), TrojanDropper:Win32/Agent.BAD (Microsoft), Win32/IRCBot.worm.variant (AhnLab).

How Can You Detect Worm.Rbot.AATS?

Worm.Rbot.AATS has typically the following processes in memory:

• %System%\cmd.exe
• %System%\taskmgr.exe
• %System%\mmc.exe

Worm.Rbot.AATS creates the following registry entries:

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

Important Article Disclaimer