high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 27 February 2005 16:26:36 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-EK is a worm which attempts to spread to remote network shares. The worm also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Forbot-EK copies itself to the Windows system folder as doit.exe and attempts to create a service with a Service Name and Display Name of "doit.exe" set to run the worm when Windows starts up.
W32/Forbot-EK sets the following registry entries so that the worm is run when a user logs on to Windows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
doit.exe
"doit.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
doit.exe
"doit.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
doit.exe
"doit.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
doit.exe
"doit.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
doit.exe
"doit.exe"
W32/Forbot-EK attempts to spread to network shares in response to commands received from a remote attacker using the backdoor component of the worm.
W32/Forbot-EK may attempt to delete network shares on the infected computer.
W32/Forbot-EK will attempt to terminate processes on the infected computer that are associated with computer security products such as AV scanners and firewalls.
|
