W32/Forbot-CR

Please follow the instructions for removing worms.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entries:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\RunOnce\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Forbot-CR is a IRC backdoor Trojan and network worm for the Windows platform.

W32/Forbot-CR copies itself to the Windows system folder with the filename msdev.exe. In order to run automatically when a user logs on the worm creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
msdev = "msdev.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
msdev = "msdev.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
msdev = "msdev.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
msdev = "msdev.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
msdev = "msdev.exe"

W32/Forbot-CR also creates its own service named "msdev.exe", with
the display name "msdev".

Once installed, W32/Forbot-CR connects to a preconfigured IRC server and joins a channel from which an attacker can issue further commands. These commands can cause the infected machine to perform any of the following actions:

flood a remote host (by either ping or HTTP)
start a SOCKS4 proxy server
start an HTTP server
start an FTP server
portscan randomly-chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files

The worm can spread to unpatched machines affected by the LSASS vulnerability (see MS04-011) and through backdoors left open by the Troj/Optix Trojans.

W32/Forbot-CR may also attempt to terminate the following processes:

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
0x1fe.exe
ad-watch.exe
agentw.EXE
agobot.exe
apvxdwin.EXE
avkpop.EXE
avkservice.EXE
avkwctl9.EXE
avpm.EXE
bbeagle.exe
bircd.exe
blackd.EXE
ccApp.EXE
ccEvtMgr.EXE
ccPxySvc.EXE
change.exe
cleaner.EXE
cleaner3.EXE
cmd.exe
cmd1.exe
cmd2.exe
cpd.EXE
Crypto3.jpg
CSRSR.exe
CSRSRS.exe
CSSSS.exe
d3dupdate.exe
defalert.EXE
defscangui.EXE
expore.exe
F-AGOBOT.EXE
f-stopw.EXE
fameh32.EXE
fbi.exe
fch32.EXE
fih32.EXE
fnrb32.EXE
forbot.exe
fsaa.EXE
fsav32.EXE
fsgk32.EXE
fsm32.EXE
fsma32.EXE
fsmb32.EXE
gbmenu.EXE
gbpoll.EXE
gov.exe
HIJACKTHIS.EXE
iamapp.EXE
iamserv.EXE
iexplorer.exe
inst.EXEexplore32.exe
irun4.exe
jpg.exebot.exe
lockdown2000.EXE
lsass2.exe
lssas.exe
msconfig.exe
mscvb32.exe
norton123.exe
notstart.EXE
novarg_upx.zip
npscheck.EXE
ntrtscan.EXE
nvsvc32.EXE
opr0371I.js
PandaAVEngine.exe
pavproxy.EXE
pccntmon.EXE
pccwin97.EXE
pcscan.EXE
Penis32.exe
phatbot.exe
photo.zip
pic33.scr
rapapp.EXE
rate.exe
rbot.exe
regedit.exe
rtvscan.EXE
rxb1ot.exe
rxbot.exe
sbserv.EXE
serasa.exe
serasa.exe.a
smsss.exe
spybot.exe
ssate.exe
sub7.exe
svchosting.exe
sysinfo.exe
SysMonXP.exe
taskmg.exe
taskmgr.exe
taskmgr1.exe
Tcpview.exe
Tcpview1.exe
vbcmserv.EXE
video.exe
vshwin32.EXE
vsmon.EXE
winagent.exe
windowsupdate.exe
winset32.exe
winsys.exe
winupd.exe
wircd.exe
WrAdmin.EXE
WrCtrl.EXE
wuarclt.exe
wupdate.exe
XPF202EN.EXE
ZAPRO.EXE
zapro.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
ZAUINST.EXE
ZONALM2601.EXE
ZONEALARM.EXE