high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | August 2008 (4.32) |
| Protection available since | 11 May 2008 06:25:33 (GMT) |
| Last updated | 18 June 2008 15:10:47 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Socks-F is a worm for the Windows platform.
W32/Socks-F includes functionality to access the internet and communicate with a remote server via HTTP.
When first run W32/Socks-F copies itself to:
<User>\cftmon.exe
<System>\drivers\spools.exe
The following registry entries are created to run cftmon.exe and spools.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ntuser
<System>\drivers\spools.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
autoload
<User>\cftmon.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ntuser
<System>\drivers\spools.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
autoload
<User>\cftmon.exe
The following registry entry is set or modified, so that cftmon.exe is run when files with extensions of EXE are opened/launched:
HKCR\exefile\shell\open\command
(default)
<User>\cftmon.exe "%1" %*
The file spools.exe is registered as a service named "Schedule" (replacing any existing services named "Schedule"). Registry entries are created or modified under:
HKLM\SYSTEM\CurrentControlSet\Services\Schedule
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
UIHost
logonui.exe
|
