Home Malware Programs Worms Fanbot

Fanbot

Posted: March 28, 2006

Fanbot is an extremely dangerous rapidly spreading Internet worm that propagates by e-mail, through file sharing networks and exploiting known Microsoft Windows vulnerabilities.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 remote.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSetupPh4nt0mHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRpcRemotesHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessStart=4HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauservStart=4
Loading...