This is Trend Micro’s detection for unknown and future variants of WORM_RONTOKBRO and WORM_BRONTOK malware programs. It serves as a proactive means of safeguarding against possible attacks of the aforementioned malware.
The said variants propagate by sending copies of themselves as attachments to email messages using their own Simple Mail Transfer Protocol (SMTP) engines. Through the said SMTP engines, they are able to easily send email messages even without using other mailing applications, such as Outlook Express.
WORM_RONTOKBRO and WORM_BRONTOK variants are also known to restart an affected system whenever certain strings are found in the title bar of any window.
In addition, these worm variants use the Windows folder icon to trick users into thinking that it is a valid folder. They also disable the Registry Editor and Task Manager.