high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | August 2006 (4.08) |
| Protection available since | 30 June 2006 20:55:29 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Cuebot-K is a instant messaging worm and backdoor for the Windows platform.
W32/Cuebot-K spreads via AOL Instant Messenger. W32/Cuebot-K is a instant messaging worm and backdoor for the Windows platform.
W32/Cuebot-K spreads via AOL Instant Messenger.
When first run W32/Cuebot-K copies itself to <Windows system folder>\wgavn.exe and creates the file <Windows folder>\Debug\dcpromo.log.
The file wgavn.exe is registered as a new system driver service named "wgavn", with a display name of "Windows Genuine Advantage Validation Notification" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\wgavn\
W32/Cuebot-K sets the following registry entries, disabling the automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
n
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\security center\
HKLM\SOFTWARE\Policies\Microsoft\windowsfirewall\domainprofile\
HKLM\SOFTWARE\Policies\Microsoft\windowsfirewall\standardprofile\
|
