W32/Socks.C Worm

 Information about the W32/Socks.C Worm:

W32/Socks.C is a worm. The worm will infect Windows systems and allows a remote intruder to gain access and control over the system.

Upon execution, the worm drops the following files:

wsusupd.exe in the root of C drive, detected as W32/Searcher.I.Downloader.Trojan,
spools.exe in Windows System\drivers folder, detected as W32/Socks.C.Worm,
ftpdll.dll in Windows System folder, detected as W32/Small.BGX.Dropper.Trojan,
ss9[1].arr in Temporary Internet Files folder,detected as W32/Searcher.I.Downloader.Trojan,
as1012[1].exe in Temporary Internet Files folder detected as W32/Searcher.I.Downloader.Trojan.

The trojan modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The trojan disables the Firewall by modifying registry at the following location:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall

The worm injects ftpdll.dll to all the processes running in the memory.

The worm attempts to connect to web-site http://85.[blocked].16 and downloads as1012.exe file.

The file spools.exe is registered as a service named "Schedule" by replacing the any existing service named "Schedule".

This information was last updated on March 10, 2008.

 Other names of W32/Socks.C Worm:

This Worm is also known as Worm.Win32.Socks.c, Win32:Small-JMK, Trojan.Downloader.Small.AAKR, Troj/Agent-GRO.