W32/Forlorn-D

Please follow the instructions for removing worms.

Please follow the instructions for removing worms.

Windows NT/2000/XP

In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\execfg4

and delete it if it exists.

Close the registry editor.

W32/Forlorn-D is a peer-to-peer (P2P) worm that spreads through the KaZaA and Morpheus network sharing utilities. When first executed the worm copies itself as EXECFG4.EXE in the Windows folder and sets the following registry entry to the path of this copy so the worm will be executed when the Windows is restarted:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\execfg4

The worm queries the following registry entries searching for a folder that is shared across the KaZaA and Morpheus networks:

HKLM\Software\Kazaa\LocalContent
HKLM\Software\Morpheus\LocalContent
HKCU\Software\Kazaa\LocalContent
HKCU\Software\Morpheus\LocalContent

If a value is not found then the folder C:\<windows>\SysConfig is used.

Seventy three copies of the worm are created in this folder with the filenames:
[DiVX] Harry Potter And The Sorcerors Stone Full Downloader.exe
[DiVX] Lord of The Rings Full Downloader.exe
Age of empires 2 crack.exe
AikaQuest3Hentai FullDownloader.exe
AIM Account Stealer Downloader.exe
Battle.net key generator (WORKS!!).exe
Borland Delphi 6 Key Generator.exe
Britney spears nude.exe
Cat Attacks Child Full Downloader.exe
CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe
CloneCD + crack.exe
CloneCD all-versions key generator.exe
Crazy Taxi Full Downloader.exe
DivX codec v6.0.exe
DivX newest version.exe
DivX patch - Increases quality.exe
DivX pro key generator.exe
DivX.exe
DSL Modem Uncapper.exe
Duke Nukem Manhattan Project Full Downloader.exe
F1 Grand Pix 4 Full Downloader.exe
Gladiator FullDownloader.exe
Grand theft auto 3 CD1 crack.exe
GTA3 crack.exe
Hack into any computer!!.exe
Hacking Tool Collection.exe
Half-life ONLINE key generator.exe
Half-life WON key generator.exe
How To Hack Websites.exe
Industry Giant II Full Downloader.exe
Internet and Computer Speed Booster.exe
Jenna Jameson - Built For Speed Downloader.exe
KaZaA media desktop v2.0 UNOFFICIAL.exe
KaZaA spyware remover.exe
Key generator for all windows XP versions.exe
Key generator for over 1,000 applications (really!).exe
LordOfTheRings-FullDownloader.exe
Macromedia dreamweaver MX (crack).exe
Macromedia Flash 5.0 Full Downloader.exe
Macromedia key generator (all products).exe
Microsoft key generator, works for ALL microsoft products!!.exe
Microsoft Office XP (english) key generator.exe
Microsoft Office XP iso Full Downloader.exe
Microsoft Windows XP crack pack.exe
MoviezChannelsInstaler.exe
MSN Password Hacker and Stealer.exe
Nero Burning Rom 5.5.9.3 Full Downloader.exe
Norton antivirus 2002.exe
PS1 Boot Disc Full Dwonloader.exe
Quake 4 BETA.exe
ScaryMovie 2 Full Downloader.exe
Shakira FullDownloader.exe
SIMS FullDownloader.exe
Sony Play station boot disc - Downloader.exe
Spiderman FullDownloader.exe
Star Wars Episode 2 - Attack Of The Clones Full Downloader.exe
Star wars episode 2 downloader.exe
Star Wars II Movie Full Downloader.exe
StarWars2 - CloneAttack - FullDownloader.exe
The Neverending Story Part I Full Downloader.exe
The Sun Of All Fears Full Downloader.exe
VS2000 Full Downloader.exe
Warcraft 3 battle.net serial generator.exe
Warcraft 3 ONLINE key generator.exe
Warcraft III Full Downloader.exe
Windows XP Full Downloader.exe
Windows XP key generator.exe
Windows XP serial generator.exe
Winrar + crack.exe
Winzip 8.0 + serial.exe
Xbox.info.exe
Zidane-ScreenInstaler.exe
ZoneAlarm Firewall Full Downloader.exe