high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | October 2004 (3.86) |
| Protection available since | 7 September 2004 18:10:59 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please read the instructions for removing W32/Forbot-G.
More Information
W32/Forbot-G is a worm which attempts to spread to remote network shares.
The worm also contains backdoor functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Forbot-G copies itself to the Windows system folder as winupdate.exe and creates entries in the registry at the following locations so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 USB2 Driver=winupdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 USB2 Driver=winupdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Win32 USB2 Driver=winupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 USB2 Driver=winupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 USB2 Driver=winupdate.exe
W32/Forbot-G attempts to spread to network machines using various exploits including the LSASS vulnerability (see MS04-011).
W32/Forbot-G may function as a proxy server, delete network shares and steal information related to popular games.
|
