high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Protection available since | 13 September 2004 09:40:06 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Forbot-T is a network worm with backdoor functionality.
When first run W32/Forbot-T copies itself to the Windows system folder as taskman.exe and creates the following registry entries so that taskman.exe is run automatically on startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Task Manager = taskman.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Task Manager = taskman.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Task Manager = taskman.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Task Manager = taskman.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Task Manager = taskman.exe
W32/Forbot-T also creates its own service named "taskman", with the display name "Task Manager".
Each time W32/Forbot-T runs it tries to connect to a remote IRC server and join a predefined channel. The Trojan then listens on the channel for instructions specified by a remote intruder.
W32/Forbot-T attempts to spread to network machines using various exploits including the LSASS vulnerability (please see MS04-011).
|
