high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | March 2006 (4.03) |
| Protection available since | 24 January 2006 05:25:25 (GMT) |
| Last updated | 24 January 2006 15:25:14 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Feebs-E is a worm for the Windows platform.
The worm may arrive as an attachment to an email claiming to be sent via "Protected Message service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.
W32/Feebs-E spreads via file sharing on P2P networks. W32/Feebs-E is a worm for the Windows platform.
The worm may arrive as an attachment to an email claiming to be sent via "Protected Message service" with bogus credentials. The message may lure the recipient into entering the supplied credentials into an attached HTML document.
W32/Feebs-E spreads via file sharing on P2P networks.
When first run W32/Feebs-E copies itself to:
<System>\ms<xx>.exe
<System>\ms<xx>
and creates the <System>\ms
The following registry entry is created to run code exported by the worm library on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
ms<xx>32.dll
<random CLSID>
The file ms<xx>32.dll is registered as a COM object, creating registry entries under:
HKCR\CLSID\<random CLSID>\InprocServer32
W32/Feebs-E copies itself to the available shared folders using the following filenames:
3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip
ACDSee_9_new!_full+crack.zip
Adobe_Photoshop_10_(CS3)_new!_full+crack.zip
Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip
Ahead_Nero_8_new!_full+crack.zip
DivX_7.0_new!_full+crack.zip
ICQ_2006_new!_full+crack.zip
Internet_Explorer_7_new!_full+crack.zip
Kazaa_4_new!_full+crack.zip
Longhorn_new!_full+crack.zip
Microsoft_Office_2006_new!_full+crack.zip
winamp_5.2_new!_full+crack.zip
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\MSAE\
|
