W32/Forbot-FC is a network worm with backdoor functionality for the Windows platform.
W32/Forbot-FC runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
When first run W32/Forbot-FC copies itself to <Windows system folder>\winsql32.exe.
The following registry entries are created to run winsql32.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Sql Service For Windows 32 Bit
winsql32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Sql Service For Windows 32 Bit
winsql32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Windows Sql Service For Windows 32 Bit
winsql32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Windows Sql Service For Windows 32 Bit
winsql32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Sql Service For Windows 32 Bit
winsql32.exe
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run
Windows Sql Service For Windows 32 Bit
winsql32.exe
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce
Windows Sql Service For Windows 32 Bit
winsql32.exe
The file winsql32.exe is registered as a new file system driver service named "WinSql", with a display name of "Windows Sql Service For Windows 32 Bit". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\WinSql\