high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Editing System.ini
At the taskbar, click Start|Run and type Sysedit. Bring System.ini to the front. In the 'shell=' line in the [Boot] section, search for any references to the files you deleted. Delete only that reference, not any other text.
Reboot your computer.
Dropped worm files
The worm may also drop itself and an autoexe.bat file on open network shares. Check other computers on your network. On any computer on which it has dropped itself, delete both the worm file and the file autoexec.bat on that computer. Replace autoexec.bat from backup.
Registry on Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry, if it is present. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
it should contain a reference to explorer.exe (or possibly NALWIN32.exe if you are using NetWare) only. Remove any reference to any file you deleted. You may need to replace the reference to explorer.exe.
Close the registry editor.
More Information
W32/Flakes-A is a worm that spreads via network shares and possesses backdoor functionality.
W32/Flakes-A copies itself as Dust.exe to the Windows system folder, the Windows temp folder and the Windows folder.
W32/Flakes-A then changes the shell parameter in the [boot] section of system.ini so that the worm runs automatically when Windows starts up, or sets the following registry entry with the same effect:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
W32/Flakes-A scans the network and attempts to connect to administrative shares of the form X$, where X is any drive letter. The worm then copies itself there and drops the file autoexec.bat there to run the copy.
W32/Flakes-A additionally connects to a remote IRC server and opens a network port.
|
