Forbot Backdoor - PrivacyAnywhere Spyware Research Library


	Home / Research


	Forbot

Details of the Forbot are shown below. This threat can be detected and cleaned using PestBlock Anti-Spyware.


Name:	Forbot
Type:	Backdoor
Risk:
Description:	Backdoor.Forbot connects to a remote IRC server from which attackers can gain access and control of infected computers.

Removal
We do not publish here the MD5 checksums for files. PestBlock Anti Spyware can identify good file from bad more accurately.

Registry Items:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\win32 update service
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\win32 update service
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win32 update service
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce\win32 update service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win32 update service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\win32 update service
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\win32 update service
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00?\Enum\Root\LEGACY_NTNDIS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00?\Services\ntndis
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00?\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\FOR_INFECT2.EXE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NTNDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ntndis
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\FOR_INFECT2.EXE

News for Sep 7, 2008

New Version!
PestBlock version 4.1. Many new featured, bugfixes. Download new version today! Learn More...

	Download Demo Version
	Buy Now!

Buy Online

	Online Store



	Discount Pricing

Spyware Research

Browse our Spyware Research Center.

	Spyware Research

Free Newsletter

Sign up for our free product newsletter today and get informed about new updates and releases by email. You will also receive the latest discounts and offers for our products!

	Click Here to Sign Up