high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | February 2007 (4.14) |
| Protection available since | 11 December 2006 04:17:10 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Mofei-T is a network worm with backdoor functionality for the Windows platform.
W32/Mofei-T may attempt to spread via network shares protected by weak passwords. W32/Mofei-T is a network worm with backdoor functionality for the Windows platform.
W32/Mofei-T may attempt to spread via network shares protected by weak passwords.
When first run W32/Mofei-T copies itself to <System>\netlog32.exe and creates the following files:
<System>\netlog32.dat
<System>\netlog32.dll
where netlog32.dat is a configuration data file and netlog32.dll is a file that provides backdoor functionality.
The file netlog32.exe is registered as a new system driver service named "netlog", with a display name of "Network Performance Alerts" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\netlog\
W32/Mofei-T provides backdoor access and control over the computer by creating a port (backdoor) and then listening for instructions being sent from a remote client.
The remote intruder will be able to carry out a variety of actions, including getting a Windows command shell, getting a content listing for selected folders, deleting files and folders, executing files and downloading files from the internet.
Sophos's anti-virus products include Behavioral Genotype™ Protection, which can proactively guard against new threats without requiring an update. Sophos customers have been protected against W32/Mofei-T (detected as Mal/Packer) since version 4.10.
|
