W32/Forbot-FN

Please follow the instructions for removing worms.

W32/Forbot-FN is a worm and IRC backdoor Trojan for the Windows platform.

W32/Forbot-FN spreads to other network computers infected with Troj/Optix and by exploiting common buffer overflow vulnerabilities, including LSASS (MS04-011) and ASN.1 (MS04-007).

W32/Forbot-FN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run W32/Forbot-FN copies itself to <System>\services32.exe.

The following registry entries are created to run services32.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Wins Update 32
services32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Wins Update 32
services32.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Wins Update 32
services32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Wins Update 32
services32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Wins Update 32
services32.exe

The file services32.exe is registered as a new file system driver service named "Win32", with a display name of "Wins Update 32". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Win32\

The following patches for the operating system vulnerabilities exploited by W32/Forbot-FN can be obtained from the Microsoft website:

MS04-011
MS04-007