high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 20 October 2004 13:06:07 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-BT is a network worm which attempts to spread via network shares. The worm contains backdoor Trojan functions that allows unauthorised remote access to the infected computer via IRC channels while running in the background.
When run W32/Forbot-BT moves itself to the Windows System folder as csrs.exe and creates the following registry entries so as to run itself either on user logon or computer restart:-
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Com+ Sys = csrs.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Com+ Sys = csrs.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Com+ Sys = csrs.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Com+ Sys = csrs.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Com+ Sys = csrs.exe
W32/Forbot-BT can spread to unpatched machines affected by the LSASS vulnerability (MS04-011).
Once installed, W32/Forbot-BT will attempt to perform the following actions when instructed to do so by a remote attacker:
- setup SOCKS4 proxy
- setup HTTP proxy
- delete network shares
- partake in denial of service (DDOS) attacks
- port scan IP addresses
The worm may also attempt to steal information from the following applications/games:
Unreal Tournament 2004
Unreal Tournament 2003
The Gladiators
Soldier of Fortune II - Double Helix
Soldiers Of Anarchy
Shogun: Total War: Warlord Edition
Ravenshield
Neverwinter Nights
Need For Speed: Underground
Need For Speed: Hot Pursuit 2
NHL 2003
NHL 2002
Nascar Racing 2003
Nascar Racing 2002
Medal of Honor: Allied Assault
Medal of Honor: Allied Assault: Spearhead
Medal of Honor: Allied Assault: Breakthrough
James Bond 007: Nightfire
Industry Giant 2
IGI2: Covert Strike
Hidden and Dangerous 2
Half-Life
Gunman Chronicles
Global Operations
Freedom Force
FIFA 2003
FIFA 2002
Counter-Strike
Command and Conquer: Tiberian Sun
Command and Conquer: Red Alert2
Command and Conquer: Generals: Zero Hour
Command and Conquer: Generals
Black and White
Battlefield 1942
Battlefield 1942: Vietnam
Battlefield 1942: The Road To Rome
Battlefield 1942: Secret Weapons Of WWII
Yahoo! Pager
AOL Instant Messenger
Call of Duty
|
