high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 4 August 2005 03:38:52 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Fan-A is a worm for the Windows platform.
W32/Fan-A searches for open Microsoft Word documents and Microsoft Excel spreadsheets and copies itself into the folder containing the document using the same name as the document and an extension of EXE.
W32/Fan-A may add the following phrases to an open Word document :
win32.anf
Happy B'day to'na!!! W32/Fan-A is a worm for the Windows platform.
W32/Fan-A searches for open Microsoft Word documents and Microsoft Excel spreadsheets and copies itself into the folder containing the document using the same name as the document and an extension of EXE.
W32/Fan-A may add the following phrases to an open Word document :
win32.anf
Happy B'day to'na!!!
The worm also creates a copy of itself named systray.exe in the Windows folder and adds the following registry entry to ensure that systray.exe is run when a user logs on :
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
System Tray
<Windows folder>\systray.exe
W32/Fan-A also sets the following registry entries :
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoSetFolders
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1
|
