W32/Forbot-CS

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entries:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\RunOnce\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Forbot-CS is a network worm which attempts to spread via network shares. The worm contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels.

When run W32/Forbot-CS moves itself to the Windows System folder as klsuicbn.exe and creates the following registry entries so as to run itself either on user logon or computer restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinAC v4
klsuicbn.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
WinAC v4
klsuicbn.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WinAC v4
klsuicbn.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
WinAC v4
klsuicbn.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
WinAC v4
klsuicbn.exe

In Windows NT-based operating systems, W32/Forbot-CS creates its own service named "WinAC" with the display name "WinAC v4" and creates the following registry entries:

HKLM\SYSTEM\CurrentControlSet\Services\WinAC\

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINAC\

Once installed, W32/Forbot-CS will attempt to setup an HTTP proxy server, delete connections to network shares, partake in distributed denial-of-service (DDoS) attacks and steal CD keys when instructed to do so by a remote attacker.

W32/Forbot-CS can spread to unpatched machines affected by the LSASS vulnerability (MS04-011).