high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please read the instructions for removing W32/Deborm-R.
More Information
W32/Deborm-R is a network worm which carries and installs Trojans. When run, the worm searches for shares named C or C$ on the local IP subnet that have no password. If a share is found the worm will attempt to copy itself to one of the following folders in the share:
Windows\Start Menu\Programs\Startup
Documents and Settings\All Users\Start Menu\Programs\Startup
Winnt\Profiles\All Users\Start Menu\Programs\Startup
W32/Deborm-R will attempt to install the Trojans Troj/Litmus-203, Troj/Sdbot-Fam and Troj/KillAV-Q.
The worm also adds the following registry entry, containing the name of the worm file so that it is run each time Windows is started:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NAV Live Update
|
