high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | October 2006 (4.10) |
| Protection available since | 13 August 2006 12:41:25 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please read the instructions for removing W32/Cuebot-L.
More Information
W32/Cuebot-L is a worm and backdoor Trojan for the Windows platform.
W32/Cuebot-L can spread to computers vulnerable to the Server Service exploit.
The following patch for the operating system vulnerability exploited by W32/Cuebot-L can be obtained from the Microsoft website:
W32/Cuebot-L spreads via AOL Instant Messenger. W32/Cuebot-L is a worm and backdoor Trojan for the Windows platform.
W32/Cuebot-L can spread to computers vulnerable to the Server Service exploit.
The following patch for the operating system vulnerability exploited by W32/Cuebot-L can be obtained from the Microsoft website:
W32/Cuebot-L spreads via AOL Instant Messenger.
When first run W32/Cuebot-L copies itself to <System>\wgareg.exe.
The file wgareg.exe is registered as a new system driver service named "wgareg", with a display name of "Windows Genuine Advantage Registration Service" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\wgareg\
W32/Cuebot-L sets the following registry entries, disabling the automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
n
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\security center\
HKLM\SOFTWARE\Policies\Microsoft\windowsfirewall\domainprofile\
HKLM\SOFTWARE\Policies\Microsoft\windowsfirewall\standardprofile\
|
