high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 9 September 2004 11:04:27 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-R is a worm and backdoor for the Windows platform.
W32/Forbot-R spreads to network shares and by exploiting backdoors opened by other malware.
When run W32/Forbot-R copies itself to the Windows system folder as syscfg32.exe. The worm adds the following registry entries to ensure that the copy is run each time Windows is started.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Win32 USB2 Driver = "syscfg32.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Win32 USB2 Driver = "syscfg32.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Win32 USB2 Driver = "syscfg32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Win32 USB2 Driver = "syscfg32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Win32 USB2 Driver = "syscfg32.exe"
The backdoor component of W32/Forbot-R may be used to launch distributed denial of service attacks, run a Socks proxy server or obtain information about the infected computer.
W32/Forbot-R attempts to disable other worms, such as members of the W32/Bagle family.
|
