high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 11 October 2004 10:26:02 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-BB is a worm and backdoor for the Windows platform. The worm spreads using network shares.
The backdoor component listens for instructions from a remote attacker.
W32/Forbot-BB copies itself to the Windows system folder as aim.exe and adds the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Aim Quick Start = "Aim.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Aim Quick Start = "Aim.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Aim Quick Start = "Aim.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Aim Quick Start = "Aim.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Aim Quick Start = "Aim.exe"
The worm also installs itself as a service named "Aim Quick Start".
W32/Forbot-BB attempts to disable other worms by deleting their registry entries and files.
The backdoor allows a remote attacker to control the infected computer, providing functions such as:
File transfer
Service control
Distributed denial of service attacks
|
