high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 13 November 2005 22:00:55 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-JG is a network worm with backdoor Trojan functionality for the Windows platform.
When first run, W32/Forbot-JG copies itself to the Windows system folder as sdsys.exe and sets the following registry entries in order to run each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Updater
"sdsys.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Windows Updater
"sdsys.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Updater
"sdsys.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Updater
"sdsys.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Windows Updater
"sdsys.exe"
Once installed, W32/Forbot-JG connects to a preconfigured IRC server and joins a channel from which an attacker can issue further commands. These commands can cause the infected computer to perform any of the following actions:
flood a remote host (by either ping or HTTP)
start a SOCKS4 proxy server
start an HTTP server
start an FTP server
portscan randomly-chosen IP addresses
execute arbitrary commands
steal information such as passwords and product keys
upload/download files
The worm can spread to unpatched computers affected by various operating system vulnerabilities such as LSASS (MS04-011), PNP (MS05-039) and ASN.1 (MS04-007) and through backdoors left open by the Troj/Optix Trojans.
Sophos's anti-virus products include Genotype™ detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against W32/Forbot-JG (detected as W32/Forbot-Fam) since version 3.98.
|
