high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-AP copies itself to the Windows system folder as sdin.exe and creates entries in the registry at the following locations so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SDIN Adapter
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\SDIN Adapter
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\SDIN Adapter
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SDIN Adapter
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\SDIN Adapter
W32/Forbot-AP also creates its own service named "gay".
W32/Forbot-AP attempts to terminate several processes related to security and anti-virus programes.
W32/Forbot-AP attempts to spread to network machines using various exploits including the LSASS vulnerability (see MS04-011). It may also utilise various other backdoor opened by other trojans to spread itself.
W32/Forbot-AP is also capable of stealing CD-Key related to various games and allowing intruder to use the infected maching to carry out network scans.
|
